Kriesi develops a niche portfolio centered on the Enfold web-application platform, where vulnerabilities recur around web-tier input handling, access control, and server-side request forgery. The vendor's disclosures acquire public exploit tooling at an elevated rate, reflecting the accessibility and appeal of web-application flaws to a broad threat community. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Kriesi over time
Signals from CVEs in this vendor scope (10 CVEs).
10 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2021-24719MEDIUM The Enfold Enfold WordPress theme before 4.8.4 was vulnerable to Reflected Cross-Site Scripting (XSS). The vulnerability is present on Enfold versions previous than 4.8.4 which use | Oct 11, 2021 | 6.1 | 31 | NO | YES |
CVE-2026-48869HIGH Unauthenticated Cross Site Scripting (XSS) in Enfold <= 7.1.4 versions. | Jun 16, 2026 | 7.1 | 25 | NO | NO |
CVE-2025-68900MEDIUM Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kriesi Enfold allows DOM-Based XSS.
This issue affects Enfold: from n/a throu | Jan 22, 2026 | 6.5 | 25 | NO | NO |
CVE-2014-7297HIGH Unspecified vulnerability in the folder framework in the Enfold theme before 3.0.1 for WordPress has unknown impact and attack vectors. | Oct 13, 2014 | 10.0 | 25 | NO | NO |
CVE-2025-66053MEDIUM Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kriesi Enfold enfold allows Stored XSS.This issue affects Enfold: from n/a thr | Nov 21, 2025 | 6.5 | 21 | NO | NO |
CVE-2023-38400MEDIUM Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kriesi Enfold - Responsive Multi-Purpose Theme allows Reflected XSS.This issue | Nov 30, 2023 | 6.1 | 19 | NO | NO |
CVE-2024-37199MEDIUM Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Kriesi.At Enfold allows Reflected XSS.This issue affects Enfold: from n | Jul 22, 2024 | 6.1 | 18 | NO | NO |
CVE-2024-13693MEDIUM The Enfold theme for WordPress is vulnerable to unauthorized access of data due to a missing capability check in avia-export-class.php in all versions up to, and including, 6.0.9. | Feb 25, 2025 | 5.3 | 17 | NO | NO |
CVE-2024-5061MEDIUM The Enfold - Responsive Multi-Purpose Theme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wrapper_class’ and 'class' parameters in all versions up to, a | Aug 30, 2024 | 5.4 | 17 | NO | NO |
CVE-2024-13695MEDIUM The Enfold theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.0.9 via the 'attachment_id' parameter. This makes it possible fo | Feb 25, 2025 | 5.4 | 16 | NO | NO |
Signals from CVEs in this vendor scope (10 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Kriesi.
Media articles that mention a CVE ID that affects a product developed by Kriesi — matched by CVE ID, not by vendor name.