What Enfold does on your site
Enfold is a multipurpose WordPress theme made by Kriesi and sold on ThemeForest, Envato’s marketplace. It handles your site’s look (header, menus, footer, colors) and ships with its own page builder, the Advanced Layout Builder. You open it from the edit screen of any page or post with the “Advanced Layout Editor” button, then drag and drop layout elements (columns, color sections, tabs), content elements (text, buttons, portfolio) and media elements (galleries, sliders, videos).
The builder only comes with the theme. Every element it places is saved as a shortcode in the page, and it keeps its data separate from the WordPress editor: you can’t switch back and forth between the two. The theme also adds an options panel (the Enfold menu), a cookie consent module, performance settings and the LayerSlider plugin.
The business model is ThemeForest’s: a one-time payment per license, which includes future updates and 6 months of support from Kriesi, extendable for a fee. Updates show up in your dashboard once the theme is connected to your Envato account.
Which sites Enfold is a good fit for
Enfold works best if you want a complete theme with a built-in builder, paid for once:
- Brochure and business websites: ready-made layouts, portfolio, sliders and a contact form are included, with no separate builder plugin to add.
- Small WooCommerce stores: the theme is listed as compatible with WooCommerce, as well as WPML, Gravity Forms, bbPress and The Events Calendar.
- European sites that care about consent: the “Privacy and Cookies” module can block Google Maps, Google Fonts, reCAPTCHA and Google tracking until the visitor accepts them, if you set it up that way.
- Budgets that rule out subscriptions: one payment per site, updates included.
It’s the wrong choice if you want to be able to switch themes without rebuilding your pages, or for an agency that ships lots of sites, since you need one license per site. To compare with a direct competitor, see our Avada review or our guide on choosing a WordPress theme.
Enfold strengths and limitations
Strengths
- A one-time payment. The regular license includes future updates, with no subscription to renew.
- Built-in cookie consent. A message bar or modal window, per-service toggles and shortcodes for your privacy page all come with the theme.
- Practical performance settings. Minified files by default, loading only the elements you use, and switches to turn off unused features (blog, external videos, emojis).
- Options you can export by tab. The “Import/Export” tab backs up every setting, Quick CSS included, and can re-import just part of them.
Limitations
- Pages tied to the theme. Advanced Layout Builder layouts are Enfold shortcodes, so leaving the theme means rebuilding them.
- One license per site. The ThemeForest regular license covers a single end product, so every new site needs a new purchase.
- Time-limited support. Only 6 months of support are included; after that you pay.
- No free version. You have to buy the theme to try it on your own site.
- Recurring XSS flaws. Several cross-site scripting bugs have been fixed in recent years, some of them exploitable without an account.
The settings we recommend for Enfold
All of these settings live in the Enfold menu of your admin area. Tab and option names are given as they appear in Kriesi’s documentation.
| Setting | Recommended value | Why |
|---|---|---|
| “Envato private token” Enfold > Theme Update | Filled in, with only the required permissions | Without a token, WordPress won’t offer new versions; three permissions are enough for updates, and a narrow token limits the damage if it leaks. |
| “CSS File Compression And Merging” and “Javascript File Compression And Merging” Enfold > Performance > File Compression | Minified files | It’s the default since Enfold 5.7 and what Kriesi recommends on HTTP/2 servers; merging sometimes causes trouble depending on the server. |
| “Disable Template Builder Elements” Enfold > Performance | Load only used elements | Only the CSS and JavaScript of elements on your pages get loaded; switch to “Always load all elements” if an element shows up unstyled. |
| “Disable External Video Features” and “Disable The Blog” Enfold > Performance > Disable Features | Checked only if the site has no YouTube or Vimeo videos and no blog | Fewer scripts loaded; leave them unchecked if a plugin relies on those pages or styles. |
| “Disable Emoji/Smiley Support” Enfold > Performance > Change WordPress Defaults | Checked | The WordPress emoji script only helps very old browsers. |
| Default cookie and services option Enfold > Privacy and Cookies | Message bar on, services blocked until the visitor agrees | By default, the theme silently accepts all cookies and services on page load, which isn’t enough for prior consent. |
| “Export Theme Settings File” Enfold > Import/Export | One export before each update, stored somewhere safe | The file restores everything in one click, but it can contain keys (Mailchimp, reCAPTCHA, Envato token), so don’t share it. |
- In Enfold > Theme Update, check for the success message after saving the token.
- After any change in the Performance tab, clear your plugin or host cache and check a few pages, ideally on a staging copy.
- Open the site in a private window: the cookie bar should appear, and Google Maps or Google Fonts shouldn’t load before you agree.
Enfold security: XSS bugs and a settings leak
Most published Enfold vulnerabilities are XSS flaws, reflected or stored. The ones worth knowing:
- CVE-2024-5061, versions up to 6.0.3: a contributor account could inject JavaScript through the
wrapper_classandclassparameters. - CVE-2024-13693, versions up to 6.0.9: an unauthenticated visitor could export all theme settings, including the Mailchimp API key, the reCAPTCHA secret key or the Envato token if they were set.
- CVE-2024-13695, versions up to 6.0.9: an SSRF through the
attachment_idparameter, reachable with a plain subscriber account. - CVE-2026-48869, fixed in 7.1.5: reflected XSS exploitable without an account.
- CVE-2026-84815, fixed in 8.1: XSS affecting versions up to 8.0.
If your site ever ran version 6.0.9 or earlier, generate a new Envato token and rotate your Mailchimp and reCAPTCHA keys. Keep Enfold updated through the token, and only buy the theme on ThemeForest: unlicensed copies are often booby-trapped (see nulled themes). WP Masquerade Pro hides the enfold folder name in file URLs, the IDs of its stylesheets and scripts, and the uploads/dynamic_avia folder, but the avia-merged-styles-*.css file names, the avia_framework_globals JavaScript variable and the avia-* and av-* classes stay visible: it slows bots down, it doesn’t fix anything.
What WP Masquerade hides for Enfold
Pro Handled by WP Masquerade Pro only
The free version does not know the traces specific to Enfold: without Pro, only generator tags are removed, as for any plugin.
Free version
Handled by WP Masquerade Pro only
With Pro
- folder name
- tag IDs
- generated-file folders
Still visible
- file names
avia-merged-styles-*.css - JavaScript variables
avia_framework_globals - CSS classes
avia-*, av-*
These traces stay because the plugin needs them to work (scripts, styles, cookies) or because they come from the server.
Enfold FAQ
Is there a free version of Enfold?
No. Enfold is sold on ThemeForest for $59, excluding tax, for a regular license that covers one site.
Do I have to pay every year to get updates?
No. Future updates are included in the license. Only support is limited to 6 months, and you can extend it for a fee.
How do I get Enfold updates inside WordPress?
Create a personal token in your Envato account, then enter it in Enfold > Theme Update. New versions will then appear under Dashboard > Updates.
Can I leave Enfold without rebuilding my pages?
Not really. Pages built with the Advanced Layout Builder are made of Enfold shortcodes, which no longer display properly with another theme. Pages written in the WordPress editor carry over fine.
Is Enfold enough for cookie consent?
It provides the message bar, the choice window and blocking for its own external services. Cookies added by other plugins have to be declared by hand, and Kriesi points out that compliance remains the site owner’s responsibility.