Avada Fusion Builder CVE-2026-12536

Exploitation requires the attacker to hold at minimum a Contributor-level authenticated account on the target WordPress installation. The Avada (Fusion) Builder plugin must be installed and active (versions up to 3.15.5). A victim with any privilege level must subsequently visit the page containing the injected Module Title. Exploitation is limited by the authenticated entry requirement and by the need for a victim to browse to the poisoned page. Sites that restrict contributor registration, enforce strong account vetting, or use a Web Application Firewall have meaningfully reduced exposure. There is no exploitation path for fully unauthenticated attackers.

The provided CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, score 6.4) contains a likely error: UI:N is inconsistent with stored XSS mechanics, which inherently require a victim to navigate to the injected page (UI:R). This discrepancy should be verified with the vendor; the realistic score with UI:R drops closer to 5.4. Regardless, the PR:L requirement - Contributor-level WordPress access - is a meaningful limiting factor on sites that do not permit open registration or untrusted contributor accounts. No EPSS data was provided, and there is no KEV listing or known POC, suggesting this has not been observed in active exploitation at time of analysis. The primary risk is on WordPress instances with open or loosely managed contributor registration, where a low-privileged attacker could persist a payload that compromises administrator sessions, escalating to full site takeover.

An attacker registers for a WordPress site that allows open user registration and is elevated to Contributor status (or already holds that role). The attacker creates or edits a page using the Avada Fusion Builder, injecting a JavaScript payload such as a cookie-stealing script into a Module Title field. Any authenticated user - including site administrators - who subsequently views that page will have the script execute in their browser, potentially exposing session cookies and enabling account takeover without any further attacker interaction. No public exploit code has been identified at time of analysis.