CVE-2025-8684 is a stored cross-site scripting vulnerability in the Flatsome WordPress theme (versions up to 3.20.0). The issue arises from insufficient input sanitization and output escaping of user-supplied attributes in the theme's shortcodes. Authenticated attackers with contributor or higher privileges can exploit this to inject arbitrary JavaScript that executes in the context of users viewing the compromised pages. This can lead to limited confidentiality and integrity impacts but does not affect availability. The vulnerability is classified under CWE-79.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages via shortcode attributes. These scripts execute in the browsers of users who view the infected pages, potentially leading to information disclosure or manipulation of page content. The CVSS score of 6.4 reflects a medium severity with network attack vector, low attack complexity, and no user interaction required. There is no indication of availability impact or known exploits in the wild at this time.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates. Until a fix is released, restrict contributor-level access to trusted users only and consider disabling or limiting the use of Flatsome shortcodes that accept user input. Avoid granting unnecessary privileges to reduce the risk of exploitation.