{ "title": "Astra theme security: every vulnerability since 2020", "seo_title": "Astra, Starter Templates and Spectra vulnerabilities", "h1": "Astra theme security: every vulnerability since 2020", "description": "The Astra theme has only 4 vulnerabilities since 2020. The Brainstorm Force plugins installed with it have had far more severe ones: the full record.", "lead": "Four medium or low-severity vulnerabilities for the Astra theme since 2020, but severe ones in Astra Pro, Starter Templates and Spectra: timeline, fixed versions and protections.", "language": "en", "locale": "en-US", "type": "article", "url": "https://www.wp-masquerade.com/astra-theme-security-vulnerabilities/", "canonical": "https://www.wp-masquerade.com/astra-theme-security-vulnerabilities/", "markdown": "https://www.wp-masquerade.com/astra-theme-security-vulnerabilities/index.md", "json": "https://www.wp-masquerade.com/astra-theme-security-vulnerabilities/index.json", "published": "2026-10-06T07:00:00+00:00", "modified": "2026-10-29T07:36:37+00:00", "site": { "name": "WP Masquerade", "url": "https://www.wp-masquerade.com/" }, "translations": [ { "language": "en", "hreflang": "en-US", "title": "Astra theme security: every vulnerability since 2020", "url": "https://www.wp-masquerade.com/astra-theme-security-vulnerabilities/", "markdown": "https://www.wp-masquerade.com/astra-theme-security-vulnerabilities/index.md", "json": "https://www.wp-masquerade.com/astra-theme-security-vulnerabilities/index.json" }, { "language": "fr", "hreflang": "fr-FR", "title": "Sécurité du thème Astra : toutes les failles depuis 2020", "url": "https://www.wp-masquerade.com/fr/failles-securite-theme-astra/", "markdown": "https://www.wp-masquerade.com/fr/failles-securite-theme-astra/index.md", "json": "https://www.wp-masquerade.com/fr/failles-securite-theme-astra/index.json" }, { "language": "es", "hreflang": "es-ES", "title": "Seguridad del tema Astra: todos sus fallos desde 2020", "url": "https://www.wp-masquerade.com/es/vulnerabilidades-tema-astra/", "markdown": "https://www.wp-masquerade.com/es/vulnerabilidades-tema-astra/index.md", "json": "https://www.wp-masquerade.com/es/vulnerabilidades-tema-astra/index.json" }, { "language": "de", "hreflang": "de-DE", "title": "Sicherheit des Astra-Themes: alle Lücken seit 2020", "url": "https://www.wp-masquerade.com/de/astra-theme-sicherheitsluecken/", "markdown": "https://www.wp-masquerade.com/de/astra-theme-sicherheitsluecken/index.md", "json": "https://www.wp-masquerade.com/de/astra-theme-sicherheitsluecken/index.json" }, { "language": "it", "hreflang": "it-IT", "title": "Sicurezza del tema Astra: tutte le vulnerabilità dal 2020", "url": "https://www.wp-masquerade.com/it/vulnerabilita-sicurezza-tema-astra/", "markdown": "https://www.wp-masquerade.com/it/vulnerabilita-sicurezza-tema-astra/index.md", "json": "https://www.wp-masquerade.com/it/vulnerabilita-sicurezza-tema-astra/index.json" }, { "language": "pt", "hreflang": "pt-BR", "title": "Segurança do tema Astra: todas as falhas desde 2020", "url": "https://www.wp-masquerade.com/pt/vulnerabilidades-seguranca-tema-astra/", "markdown": "https://www.wp-masquerade.com/pt/vulnerabilidades-seguranca-tema-astra/index.md", "json": "https://www.wp-masquerade.com/pt/vulnerabilidades-seguranca-tema-astra/index.json" }, { "language": "nl", "hreflang": "nl-NL", "title": "Beveiliging van het Astra-thema: de kwetsbaarheden sinds 2020", "url": "https://www.wp-masquerade.com/nl/astra-thema-kwetsbaarheden-beveiliging/", "markdown": "https://www.wp-masquerade.com/nl/astra-thema-kwetsbaarheden-beveiliging/index.md", "json": "https://www.wp-masquerade.com/nl/astra-thema-kwetsbaarheden-beveiliging/index.json" } ], "headings": [ { "level": 1, "text": "Astra theme security: every vulnerability since 2020" }, { "level": 2, "text": "Astra in brief" }, { "level": 2, "text": "Timeline of vulnerabilities from 2020 to October 2026" }, { "level": 3, "text": "The Astra theme: four vulnerabilities in six years" }, { "level": 3, "text": "The Brainstorm Force ecosystem: the notable vulnerabilities" }, { "level": 2, "text": "The notable vulnerabilities explained" }, { "level": 3, "text": "The theme: XSS, and nothing more" }, { "level": 3, "text": "Astra Pro: the two most severe vulnerabilities in the ecosystem" }, { "level": 3, "text": "Starter Templates: the importer, a door to the server" }, { "level": 3, "text": "Spectra and Spectra Pro: from blocks to privileges" }, { "level": 2, "text": "What this history shows" }, { "level": 2, "text": "How to protect your site" }, { "level": 3, "text": "Key takeaways" }, { "level": 2, "text": "Sources" }, { "level": 2, "text": "WordPress security, without the noise", "id": "wpm-nl-box-title" } ], "body": "Installed on more than a million sites, Astra is one of the most widely used WordPress themes, and one of the least affected: four vulnerabilities published since 2020, none of high severity. That reassuring record, however, only applies to the theme. The Brainstorm Force plugins that often come with it, Starter Templates, Spectra or Astra Pro, have had far more serious vulnerabilities. Here are both histories, clearly separated, and what you need to update.\n\n## Astra in brief\n\nAstra is a free theme released on wordpress.org in May 2017 by Brainstorm Force, the vendor also behind Ultimate Addons for Elementor (whose [vulnerability history](https://www.wp-masquerade.com/ultimate-addons-elementor-security-vulnerabilities/) we have traced), Spectra and Starter Templates. Lightweight and compatible with Elementor, Gutenberg and WooCommerce, it has more than one million active installations (wordpress.org).\n\nLike most modern themes, Astra works as an ecosystem. The theme provides the layout and the header and footer, configurable in the Customizer. Demo sites are imported with the Starter Templates plugin (more than one million active installations), advanced blocks come from Spectra (more than one million), and Astra Pro's premium features rely on a separate paid plugin, Astra Pro Addon. On a real site, the attack surface is therefore that of the whole set, not just the theme.\n\nIts popularity makes it a natural target: a vulnerability in the theme would be replicated identically on a million sites. That is precisely what makes its history interesting: it shows that a very widespread theme can stay very lightly exposed when it sticks to its role.\n\n## Timeline of vulnerabilities from 2020 to October 2026\n\n![Timeline: July 8, 2021, unauthenticated SQL injection in Astra Pro, fixed in 3.5.2; September 5, 2023, server-side request forgery in Starter Templates, fixed in 3.2.5; December 5, 2023, code execution by a contributor in Astra Pro, critical, fixed in 4.3.2; March 25, 2024, two stored XSS in the theme, fixed in 4.6.5 and 4.6.9; May 9, 2024, privilege escalation in Spectra Pro, fixed in 1.1.6; December 5, 2025, arbitrary file upload in Starter Templates, fixed in 4.4.42; January 19, 2026, unauthenticated font deletion in Custom Fonts; February 2, 2026, protected excerpts readable without an account in Spectra; March 10, 2026, XSS in the theme fixed in 4.12.4; May 29, 2026, code execution by a contributor in Spectra, fixed in 2.19.26; September 30, 2026, CSS injection in the theme, low, fixed in 4.14.0.](https://www.wp-masquerade.com/media/2026/10/chronologie-failles-astra-en.webp)\n\n*Dates are the publication dates of each vulnerability. The prefix shows the product: the theme itself only appears three times.*\n\n### The Astra theme: four vulnerabilities in six years\n\nWPScan and Patchstack list the same four vulnerabilities for the theme between January 1, 2020 and October 3, 2026. The [CVSS score](https://www.wp-masquerade.com/glossary/cvss/) is the one from the authority that assigned the [CVE](https://www.wp-masquerade.com/glossary/cve/). None is documented as exploited.\n\n| Published | Fixed in | Type | CVSS | CVE | Account required |\n| --- | --- | --- | --- | --- | --- |\n| March 25, 2024 | 4.6.9 | Stored XSS (user display name) | 6.4 (Wordfence) | CVE-2024-2347 | Contributor |\n| March 25, 2024 | 4.6.5 | Stored XSS (header and footer) | 5.9 (Patchstack) | CVE-2024-29768 | Editor |\n| March 10, 2026 | 4.12.4 | Stored XSS (page background settings) | 6.4 (Wordfence) | CVE-2026-3534 | Contributor |\n| September 30, 2026 | 4.14.0 | CSS injection (global color palette) | 2.7 (Patchstack) | CVE-2026-27085 | Shop manager |\n\n*Astra theme: 4 vulnerabilities published between 2020 and October 3, 2026 (sources: WPScan, Patchstack, CVE records).*\n\n### The Brainstorm Force ecosystem: the notable vulnerabilities\n\nThis second table is not about the theme but about plugins from the same vendor that are often installed with it. It only includes significant vulnerabilities: high or critical severity, or exploitable without an account. The volumes are much larger: WPScan lists 10 vulnerabilities for Starter Templates and 21 for Spectra over the same period.\n\n| Published | Plugin | Fixed in | Type | CVSS | CVE | Account required |\n| --- | --- | --- | --- | --- | --- | --- |\n| July 8, 2021 | Astra Pro Addon (paid) | 3.5.2 | SQL injection | 8.6 (WPScan), 9.8 (NVD) | CVE-2021-24507 | None |\n| September 5, 2023 | Starter Templates | 3.2.5 | Server-side request forgery (SSRF) | 7.1 (Patchstack) | CVE-2023-41804 | Contributor |\n| December 5, 2023 | Astra Pro (paid) | 4.3.2 | Remote code execution | 9.9 (Patchstack) | CVE-2023-49830 | Contributor |\n| May 9, 2024 | Spectra Pro (paid) | 1.1.6 | Privilege escalation | 8.8 (Wordfence) | CVE-2024-3828 | Author |\n| December 5, 2025 | Starter Templates | 4.4.42 | Arbitrary file upload | 8.8 (Wordfence) | CVE-2025-13065 | Author |\n| January 19, 2026 | Custom Fonts | 2.1.17 | Font deletion, missing authorization | 5.3 (Wordfence) | CVE-2025-14351 | None |\n| February 2, 2026 | Spectra | 2.19.18 | Disclosure of password-protected excerpts | 5.3 (Wordfence) | CVE-2026-0950 | None |\n| May 29, 2026 | Spectra | 2.19.26 | Remote code execution | 8.8 (Wordfence) | CVE-2026-7465 | Contributor |\n\n*Brainstorm Force plugins: a selection of significant vulnerabilities from 2021 to October 3, 2026 (sources: WPScan, Patchstack, CVE records, NVD).*\n\n## The notable vulnerabilities explained\n\n### The theme: XSS, and nothing more\n\nThe theme's first three vulnerabilities are stored [XSS](https://www.wp-masquerade.com/glossary/xss/): a logged-in user saves JavaScript in a field that the theme later displays without neutralizing it, and that code runs in every visitor's browser. If the victim is an administrator, the script acts with their permissions (see our article on XSS vulnerabilities).\n\nIn March 2024, Matthew Rollings showed that a contributor could place code in their display name, which the theme then reused in pages (CVE-2024-2347). Wordfence notified the vendor on March 11; version 4.6.9 was released on March 23, two days before publication. The same day, Patchstack published an XSS in the header and footer, exploitable by an editor (CVE-2024-29768), already fixed in 4.6.5 since February 12.\n\nIn March 2026, Alex Hickey found that a page's background settings, stored in metadata a contributor can edit, were inserted into the page's CSS without escaping (CVE-2026-3534). Reported on March 4, fixed on March 10 in 4.12.4 and published the same day. Finally, CVE-2026-27085, published on September 30, 2026, lets a WooCommerce shop manager inject CSS through the global color palette. Its 2.7 score makes it a low-severity vulnerability: this role already has broad permissions, and the impact is limited to the site's appearance.\n\nAstra's changelog also mentions security fixes that had no public record as of October 3, 2026: HTML content accepted without the `unfiltered_html` capability and XSS in the header Account element (versions 4.13.11 and 4.13.12, September 2026), XSS in live search (4.14.0, September 24). More records could therefore be added to the tally; they all target versions that are already fixed.\n\n### Astra Pro: the two most severe vulnerabilities in the ecosystem\n\nThe paid Astra Pro Addon plugin holds the two highest scores. In July 2021, WPScan published an SQL injection discovered by Ngoc Nguyen: two infinite pagination AJAX actions, available to logged-out visitors, inserted unfiltered parameters into SQL queries (CVE-2021-24507, fixed in 3.5.2). An attacker could thus query the site's database without an account.\n\nIn December 2023, Patchstack published a code execution vulnerability in Astra Pro up to 4.3.1, exploitable with a mere contributor account (CVE-2023-49830, CVSS 9.9). Reported on August 28, 2023 by Rafie Muhammad, it was fixed in 4.3.2; Patchstack did not publish the technical details. Since Astra Pro is not distributed through wordpress.org, its updates come through the Brainstorm Force account: check that they actually reach your site.\n\n### Starter Templates: the importer, a door to the server\n\nStarter Templates imports complete sites: pages, images, settings. This feature handles files and remote URLs, which explains its two most serious vulnerabilities. In 2023, Rafie Muhammad (Patchstack) showed that a contributor could make the server send requests to URLs of their choosing (SSRF, CVE-2023-41804), fixed in 3.2.5. In December 2025, Michael Mazzolini bypassed the check on WXR import files with a double extension: an author could drop an arbitrary file on the server, which can lead to code execution (CVE-2025-13065, CVSS 8.8). Wordfence notified the vendor on November 12, 2025; version 4.4.42 was released on November 14, three weeks before publication.\n\nOnce the site is built, this plugin is often no longer needed. Uninstalling it removes that attack surface in one go.\n\n### Spectra and Spectra Pro: from blocks to privileges\n\nSpectra, Brainstorm Force's Gutenberg block library, has 21 vulnerabilities in WPScan from 2020 to October 3, 2026, half of them stored XSS by contributors. Since version 2.20.0 of July 14, 2026, it is called Spectra Legacy and only receives fixes; new features go into a new plugin, Spectra Blocks. Two 2026 vulnerabilities stand out. CVE-2026-0950 let any visitor read the excerpt of a password-protected post, displayed by the post grid or post carousel blocks (fixed in 2.19.18). CVE-2026-7465, more severe, let a contributor run a PHP function of their choice by declaring a fake block in a post's content: that is code execution on the server (CVSS 8.8). Reported on April 29, 2026 by Supanat Konprom, it was fixed in 2.19.26 on May 4 and published on May 29.\n\nIn Spectra Pro, the paid version, an author could create a registration form that assigned the administrator role to new accounts (CVE-2024-3828, CVSS 8.8, published on May 9, 2024), fixed in 1.1.6. Finally, the Custom Fonts plugin (more than 400,000 active installations) let a logged-out visitor delete the fonts folder and rewrite the `theme.json` file (CVE-2025-14351, fixed in 2.1.17).\n\n## What this history shows\n\n- **A lightly exposed theme**: four vulnerabilities in six years for more than a million sites, all requiring an account, none of high severity. Astra sticks to display and leaves complex features to plugins.\n- **The risk lies in the ecosystem**: unauthenticated SQL injection, code execution by a contributor, file upload by an author. The severe vulnerabilities are found in the plugins that import, generate or execute content.\n- **Fixes before the announcement**: for the vulnerabilities whose dates are published, the fixed version was available before or on the day of publication.\n- **The same pattern as elsewhere**: the OceanWP theme shows the same gap between a lightly affected theme and its companion plugin, Ocean Extra (see [OceanWP's vulnerabilities](https://www.wp-masquerade.com/oceanwp-theme-security-vulnerabilities/)). And [the WordPress core timeline](https://www.wp-masquerade.com/wordpress-core-vulnerabilities-timeline/) is a reminder that no software escapes patches.\n\n## How to protect your site\n\n- **Update everything**: as of October 3, 2026, aim for at least Astra 4.14.0, Starter Templates 4.7.6, Spectra 2.20.1 and Custom Fonts 2.1.17 (each one's latest published vulnerabilities). For Astra Pro and Spectra Pro, check that updates arrive through your Brainstorm Force account.\n- **Turn on automatic updates** for the theme and the free plugins; our guide to automatic updates explains how to limit the risk of breakage.\n- **Uninstall Starter Templates** once the site is imported, along with any plugin from the ecosystem you do not use (see abandoned and unused plugins).\n- **Limit accounts**: almost all of these vulnerabilities require a contributor or author account. Keep those roles for the people who need them (roles and least privilege).\n- **Add a web application firewall** to cover the gap between the announcement and the update (our WordPress firewall comparison).\n- **Watch the advisories** for the theme and each plugin, as described in our vulnerability monitoring method.\n\nWP Masquerade Pro helps with that last point. Every day, it compares the installed versions of your plugins and themes with the public WPVulnerability.net database and sends you a [vulnerability alert](https://www.wp-masquerade.com/features/vulnerable-plugin-alerts/) by [email](https://www.wp-masquerade.com/features/email-alerts/), with the severity and the fixed version. In the member area, [monitoring your sites](https://www.wp-masquerade.com/features/#surveillance) brings together pending updates and vulnerable sites. WP Masquerade alerts, it fixes neither the theme nor the plugins and it is not a firewall: updating remains the decisive step. To choose a firewall, see our [comparison of the best WordPress security plugins](https://www.wp-masquerade.com/best-wordpress-security-plugins/).\n\n### Key takeaways\n\n- The Astra theme has 4 vulnerabilities published from 2020 to October 3, 2026, all requiring an account and none of high severity.\n- The ecosystem's severe vulnerabilities hit the plugins: Astra Pro (unauthenticated SQL injection in 2021, code execution in 2023), Starter Templates and Spectra.\n- None is documented as exploited by a recognized source; fixes were released before or on the day of the announcement when the dates are known.\n- Update the theme and plugins, and delete Starter Templates once the site is imported.\n\n## Sources\n\n- WordPress.org: Astra theme, theme page and active installations (https://wordpress.org/themes/astra/)\n- CVE.org: CVE-2024-2347, Astra 4.6.8 and earlier (April 9, 2024) (https://www.cve.org/CVERecord?id=CVE-2024-2347)\n- CVE.org: CVE-2024-29768, Astra 4.6.4 and earlier (March 27, 2024) (https://www.cve.org/CVERecord?id=CVE-2024-29768)\n- WordPress.org: Spectra Legacy, plugin page and changelog (https://wordpress.org/plugins/ultimate-addons-for-gutenberg/)\n\nOther sources consulted: further CVE records, WPScan and Patchstack databases.\n\n## WordPress security, without the noise\n\nOne e-mail when something matters: new attacks seen in the wild, plugin updates and practical guides. No spam, unsubscribe in one click.", "categories": [ "Vulnerable themes" ], "format": "application/json" }