The Flatsome WordPress theme versions up to 3.18.7 contain a stored cross-site scripting vulnerability due to improper neutralization of input during web page generation (CWE-79). Authenticated attackers with contributor-level privileges can inject arbitrary JavaScript code via shortcode attributes that are not properly sanitized or escaped. This malicious code executes in the context of users visiting the compromised pages, potentially leading to session hijacking or other client-side attacks. The vulnerability is confirmed and published with a CVSS 3.1 score of 6.4 (medium severity). No patch or official remediation details have been disclosed yet.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages via shortcode attributes. These scripts execute in the browsers of users who view the infected pages, potentially compromising user sessions or performing unauthorized actions within the context of the victim's browser. The vulnerability does not affect availability but impacts confidentiality and integrity to a limited extent. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or limiting the use of vulnerable shortcode features. Monitor vendor channels for updates and apply patches promptly once released.