What is the CVSS score of CVE-2026-12536?

CVE-2026-12536 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Avada Fusion Builder CVE-2026-12536

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-13 Wordfence

WordPress XSS Avada Fusion Builder Themefusion

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Stored XSS requires a victim to visit the page (UI:R, not UI:N as provided); PR:L reflects mandatory Contributor authentication; S:C captures cross-browser-boundary execution.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 20:31 vuln.today

CVE Published

Jul 13, 2026 - 19:33 nvd

MEDIUM 6.4

DescriptionCVE.org

The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Module Title’ parameter in all versions up to, and including, 3.15.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the Avada (Fusion) Builder WordPress plugin versions up to 3.15.5 allows authenticated contributors to inject persistent malicious scripts via the 'Module Title' parameter, executing in the browsers of any user who views the affected page. This grants attackers the ability to steal session tokens, perform unauthorized actions on behalf of victims, or redirect users to malicious sites. No public exploit or CISA KEV listing has been identified at time of analysis, though the Contributor-level entry bar makes this accessible to a broad attacker pool on sites with open registration.

Technical ContextAI

The vulnerability resides in the Avada (Fusion) Builder plugin (CPE: cpe:2.3:a:themefusion:avada_(fusion)_builder:*:*:*:*:*:*:*:*), a widely-used page builder bundled with the Avada WordPress theme sold on ThemeForest. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a failure to sanitize input on the 'Module Title' parameter and to escape output when rendering it to HTML. Stored XSS persists in the database and executes in the victim's browser context on every page load, rather than requiring per-request injection like reflected variants. The CVSS vector indicates Scope:Changed (S:C), reflecting that the injected script crosses the security boundary from the server-side application into the victim client's browser environment.

RemediationAI

Update the Avada (Fusion) Builder plugin to the version released after 3.15.5 as soon as ThemeFusion publishes a patched release; monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/6199b852-3270-4456-934b-68c3ef11b9e5?source=cve and the official ThemeForest listing for patch announcements. No exact fixed version is confirmed in the available data at time of analysis. As a compensating control, restrict Contributor-level role assignment to only fully trusted users and disable open user registration if not operationally required - this removes the primary attack surface since exploitation requires at minimum Contributor access. Additionally, deploying a Web Application Firewall rule targeting stored script payloads in page builder title fields can reduce exposure, though it may interfere with legitimate rich-text content. Note that the Wordfence plugin for WordPress provides virtual patching for known vulnerabilities, which may offer interim protection while awaiting the official patch.