Installed on more than a million sites, Astra is one of the most widely used WordPress themes, and one of the least affected: four vulnerabilities published since 2020, none of high severity. That reassuring record, however, only applies to the theme. The Brainstorm Force plugins that often come with it, Starter Templates, Spectra or Astra Pro, have had far more serious vulnerabilities. Here are both histories, clearly separated, and what you need to update.
Astra in brief
Astra is a free theme released on wordpress.org in May 2017 by Brainstorm Force, the vendor also behind Ultimate Addons for Elementor (whose vulnerability history we have traced), Spectra and Starter Templates. Lightweight and compatible with Elementor, Gutenberg and WooCommerce, it has more than one million active installations (wordpress.org).
Like most modern themes, Astra works as an ecosystem. The theme provides the layout and the header and footer, configurable in the Customizer. Demo sites are imported with the Starter Templates plugin (more than one million active installations), advanced blocks come from Spectra (more than one million), and Astra Pro's premium features rely on a separate paid plugin, Astra Pro Addon. On a real site, the attack surface is therefore that of the whole set, not just the theme.
Its popularity makes it a natural target: a vulnerability in the theme would be replicated identically on a million sites. That is precisely what makes its history interesting: it shows that a very widespread theme can stay very lightly exposed when it sticks to its role.
Timeline of vulnerabilities from 2020 to October 2026
The Astra theme: four vulnerabilities in six years
WPScan and Patchstack list the same four vulnerabilities for the theme between January 1, 2020 and October 3, 2026. The CVSS score is the one from the authority that assigned the CVE. None is documented as exploited.
| Published | Fixed in | Type | CVSS | CVE | Account required |
|---|---|---|---|---|---|
| March 25, 2024 | 4.6.9 | Stored XSS (user display name) | 6.4 (Wordfence) | CVE-2024-2347 | Contributor |
| March 25, 2024 | 4.6.5 | Stored XSS (header and footer) | 5.9 (Patchstack) | CVE-2024-29768 | Editor |
| March 10, 2026 | 4.12.4 | Stored XSS (page background settings) | 6.4 (Wordfence) | CVE-2026-3534 | Contributor |
| September 30, 2026 | 4.14.0 | CSS injection (global color palette) | 2.7 (Patchstack) | CVE-2026-27085 | Shop manager |
The Brainstorm Force ecosystem: the notable vulnerabilities
This second table is not about the theme but about plugins from the same vendor that are often installed with it. It only includes significant vulnerabilities: high or critical severity, or exploitable without an account. The volumes are much larger: WPScan lists 10 vulnerabilities for Starter Templates and 21 for Spectra over the same period.
| Published | Plugin | Fixed in | Type | CVSS | CVE | Account required |
|---|---|---|---|---|---|---|
| July 8, 2021 | Astra Pro Addon (paid) | 3.5.2 | SQL injection | 8.6 (WPScan), 9.8 (NVD) | CVE-2021-24507 | None |
| September 5, 2023 | Starter Templates | 3.2.5 | Server-side request forgery (SSRF) | 7.1 (Patchstack) | CVE-2023-41804 | Contributor |
| December 5, 2023 | Astra Pro (paid) | 4.3.2 | Remote code execution | 9.9 (Patchstack) | CVE-2023-49830 | Contributor |
| May 9, 2024 | Spectra Pro (paid) | 1.1.6 | Privilege escalation | 8.8 (Wordfence) | CVE-2024-3828 | Author |
| December 5, 2025 | Starter Templates | 4.4.42 | Arbitrary file upload | 8.8 (Wordfence) | CVE-2025-13065 | Author |
| January 19, 2026 | Custom Fonts | 2.1.17 | Font deletion, missing authorization | 5.3 (Wordfence) | CVE-2025-14351 | None |
| February 2, 2026 | Spectra | 2.19.18 | Disclosure of password-protected excerpts | 5.3 (Wordfence) | CVE-2026-0950 | None |
| May 29, 2026 | Spectra | 2.19.26 | Remote code execution | 8.8 (Wordfence) | CVE-2026-7465 | Contributor |
The notable vulnerabilities explained
The theme: XSS, and nothing more
The theme's first three vulnerabilities are stored XSS: a logged-in user saves JavaScript in a field that the theme later displays without neutralizing it, and that code runs in every visitor's browser. If the victim is an administrator, the script acts with their permissions (see our article on XSS vulnerabilities).
In March 2024, Matthew Rollings showed that a contributor could place code in their display name, which the theme then reused in pages (CVE-2024-2347). Wordfence notified the vendor on March 11; version 4.6.9 was released on March 23, two days before publication. The same day, Patchstack published an XSS in the header and footer, exploitable by an editor (CVE-2024-29768), already fixed in 4.6.5 since February 12.
In March 2026, Alex Hickey found that a page's background settings, stored in metadata a contributor can edit, were inserted into the page's CSS without escaping (CVE-2026-3534). Reported on March 4, fixed on March 10 in 4.12.4 and published the same day. Finally, CVE-2026-27085, published on September 30, 2026, lets a WooCommerce shop manager inject CSS through the global color palette. Its 2.7 score makes it a low-severity vulnerability: this role already has broad permissions, and the impact is limited to the site's appearance.
Astra's changelog also mentions security fixes that had no public record as of October 3, 2026: HTML content accepted without the unfiltered_html capability and XSS in the header Account element (versions 4.13.11 and 4.13.12, September 2026), XSS in live search (4.14.0, September 24). More records could therefore be added to the tally; they all target versions that are already fixed.
Astra Pro: the two most severe vulnerabilities in the ecosystem
The paid Astra Pro Addon plugin holds the two highest scores. In July 2021, WPScan published an SQL injection discovered by Ngoc Nguyen: two infinite pagination AJAX actions, available to logged-out visitors, inserted unfiltered parameters into SQL queries (CVE-2021-24507, fixed in 3.5.2). An attacker could thus query the site's database without an account.
In December 2023, Patchstack published a code execution vulnerability in Astra Pro up to 4.3.1, exploitable with a mere contributor account (CVE-2023-49830, CVSS 9.9). Reported on August 28, 2023 by Rafie Muhammad, it was fixed in 4.3.2; Patchstack did not publish the technical details. Since Astra Pro is not distributed through wordpress.org, its updates come through the Brainstorm Force account: check that they actually reach your site.
Starter Templates: the importer, a door to the server
Starter Templates imports complete sites: pages, images, settings. This feature handles files and remote URLs, which explains its two most serious vulnerabilities. In 2023, Rafie Muhammad (Patchstack) showed that a contributor could make the server send requests to URLs of their choosing (SSRF, CVE-2023-41804), fixed in 3.2.5. In December 2025, Michael Mazzolini bypassed the check on WXR import files with a double extension: an author could drop an arbitrary file on the server, which can lead to code execution (CVE-2025-13065, CVSS 8.8). Wordfence notified the vendor on November 12, 2025; version 4.4.42 was released on November 14, three weeks before publication.
Once the site is built, this plugin is often no longer needed. Uninstalling it removes that attack surface in one go.
Spectra and Spectra Pro: from blocks to privileges
Spectra, Brainstorm Force's Gutenberg block library, has 21 vulnerabilities in WPScan from 2020 to October 3, 2026, half of them stored XSS by contributors. Since version 2.20.0 of July 14, 2026, it is called Spectra Legacy and only receives fixes; new features go into a new plugin, Spectra Blocks. Two 2026 vulnerabilities stand out. CVE-2026-0950 let any visitor read the excerpt of a password-protected post, displayed by the post grid or post carousel blocks (fixed in 2.19.18). CVE-2026-7465, more severe, let a contributor run a PHP function of their choice by declaring a fake block in a post's content: that is code execution on the server (CVSS 8.8). Reported on April 29, 2026 by Supanat Konprom, it was fixed in 2.19.26 on May 4 and published on May 29.
In Spectra Pro, the paid version, an author could create a registration form that assigned the administrator role to new accounts (CVE-2024-3828, CVSS 8.8, published on May 9, 2024), fixed in 1.1.6. Finally, the Custom Fonts plugin (more than 400,000 active installations) let a logged-out visitor delete the fonts folder and rewrite the theme.json file (CVE-2025-14351, fixed in 2.1.17).
What this history shows
- A lightly exposed theme: four vulnerabilities in six years for more than a million sites, all requiring an account, none of high severity. Astra sticks to display and leaves complex features to plugins.
- The risk lies in the ecosystem: unauthenticated SQL injection, code execution by a contributor, file upload by an author. The severe vulnerabilities are found in the plugins that import, generate or execute content.
- Fixes before the announcement: for the vulnerabilities whose dates are published, the fixed version was available before or on the day of publication.
- The same pattern as elsewhere: the OceanWP theme shows the same gap between a lightly affected theme and its companion plugin, Ocean Extra (see OceanWP's vulnerabilities). And the WordPress core timeline is a reminder that no software escapes patches.
How to protect your site
- Update everything: as of October 3, 2026, aim for at least Astra 4.14.0, Starter Templates 4.7.6, Spectra 2.20.1 and Custom Fonts 2.1.17 (each one's latest published vulnerabilities). For Astra Pro and Spectra Pro, check that updates arrive through your Brainstorm Force account.
- Turn on automatic updates for the theme and the free plugins; our guide to automatic updates explains how to limit the risk of breakage.
- Uninstall Starter Templates once the site is imported, along with any plugin from the ecosystem you do not use (see abandoned and unused plugins).
- Limit accounts: almost all of these vulnerabilities require a contributor or author account. Keep those roles for the people who need them (roles and least privilege).
- Add a web application firewall to cover the gap between the announcement and the update (our WordPress firewall comparison).
- Watch the advisories for the theme and each plugin, as described in our vulnerability monitoring method.
WP Masquerade Pro helps with that last point. Every day, it compares the installed versions of your plugins and themes with the public WPVulnerability.net database and sends you a vulnerability alert by email, with the severity and the fixed version. In the member area, monitoring your sites brings together pending updates and vulnerable sites. WP Masquerade alerts, it fixes neither the theme nor the plugins and it is not a firewall: updating remains the decisive step. To choose a firewall, see our comparison of the best WordPress security plugins.
Key takeaways
- The Astra theme has 4 vulnerabilities published from 2020 to October 3, 2026, all requiring an account and none of high severity.
- The ecosystem's severe vulnerabilities hit the plugins: Astra Pro (unauthenticated SQL injection in 2021, code execution in 2023), Starter Templates and Spectra.
- None is documented as exploited by a recognized source; fixes were released before or on the day of the announcement when the dates are known.
- Update the theme and plugins, and delete Starter Templates once the site is imported.
Sources
- WordPress.org: Astra theme, theme page and active installations (external link, opens in a new tab)
- CVE.org: CVE-2024-2347, Astra 4.6.8 and earlier (April 9, 2024) (external link, opens in a new tab)
- CVE.org: CVE-2024-29768, Astra 4.6.4 and earlier (March 27, 2024) (external link, opens in a new tab)
- WordPress.org: Spectra Legacy, plugin page and changelog (external link, opens in a new tab)
Other sources consulted: further CVE records, WPScan and Patchstack databases.
