Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kriesi Enfold allows Reflected XSS. This issue affects Enfold: from n/a through 8.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.8",
  "pubDate": "2026-09-03T14:17:03.530Z",
  "pubdate": "2026-09-03T14:17:03.530Z",
  "executiveSummary": "The Kriesi Enfold theme is susceptible to a Reflected Cross-Site Scripting (XSS) vulnerability, classified under CWE-79: Improper Neutralization of Input During Web Page Generation.\nThis vulnerability occurs due to insufficient sanitization of user-supplied data before it is reflected back to the user's browser within the context of a web page.\nThe flaw affects the Enfold product in all versions from n/a through 8.0.\nAn unauthenticated, remote attacker can exploit this vulnerability by crafting a malicious URL containing a payload, which, when accessed by a victim, executes arbitrary JavaScript within their active session.\nSuccessful exploitation could lead to session hijacking, unauthorized actions performed on behalf of the user, theft of sensitive authentication cookies, or redirection to malicious third-party domains.\nThe vulnerability represents a significant risk to site integrity and user data confidentiality, as it enables attackers to manipulate the client-side environment of legitimate users.",
  "technicalDetails": "The vulnerability resides in the way the Enfold theme processes HTTP request parameters before rendering them in the HTML response. Because the application fails to properly neutralize or encode user input, it allows for the injection of arbitrary HTML and JavaScript tags into the DOM (Document Object Model).\nRoot Cause: The root cause is a failure in input validation and output encoding mechanisms. Specifically, data received via GET or POST requests is reflected directly into the application's output stream without passing through adequate filtering mechanisms that would render potential script tags inert.\nExploitation Method: An attacker performs the attack by tricking a victim into clicking a specially crafted URL or submitting a manipulated form. The payload is typically embedded as a URL query parameter. When the server processes this request, it reflects the malicious payload back into the rendered HTML source code.\nAttack Flow: 1. An attacker identifies a page or endpoint within the Enfold theme that reflects input parameters directly into the DOM. 2. The attacker crafts a URI containing an XSS payload, such as '<script>alert(document.cookie)</script>', within the vulnerable parameter. 3. The attacker distributes this URL via phishing, social engineering, or public links. 4. Upon the victim navigating to the malicious URL, the Enfold-powered site processes the input and includes the unencoded script in the HTML response. 5. The victim's browser interprets the injected JavaScript and executes the payload within the context of the user's session.\nAffected Versions: Enfold versions from n/a through 8.0 are confirmed to be impacted.\nAuthentication/Privilege Requirements: Exploitation does not require prior authentication or elevated privileges, as the reflected payload executes in the browser of any user (authenticated or unauthenticated) who interacts with the malicious link.\nNetwork Exposure: The vulnerability is exploitable over the network (Internet-facing) and does not require local access.\nPayload Behavior: The injected payload operates within the scope of the origin, allowing the attacker to interact with the DOM, access browser-based APIs, exfiltrate session cookies, perform requests to internal APIs, or inject fraudulent content into the page.\nPost-Exploitation Impact: The attacker can gain complete control over the victim's session, perform unauthorized administrative or user actions, or facilitate further attacks, such as stealing OAuth tokens or CSRF tokens that could be leveraged for larger compromises."
}