EUVD-2026-31211
GHSA-c7gm-xj5j-p869
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from Vendor (Wordfence) · only source for this CVE.
CVSS VectorVendor: Wordfence
Lifecycle Timeline
1DescriptionCVE.org
The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcodes in all versions up to, and including, 3.15.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user (typically an administrator) accesses a page displaying dynamic user data (such as via the Dynamic Data feature pulling user biographical information).
AnalysisAI
Stored Cross-Site Scripting in Avada (Fusion) Builder for WordPress (all versions through 3.15.2) allows authenticated attackers with Subscriber-level access to persist malicious JavaScript via unsanitized shortcode parameters. The injected scripts execute in the browser of any user - typically an administrator - who views a page rendering dynamic user data such as biographical information sourced through the plugin's Dynamic Data feature. With CVSS Scope set to Changed (S:C), successful exploitation crosses the victim's security boundary, enabling session hijacking or privilege escalation against higher-privileged users. No public exploit code or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation) describes the root cause: the plugin's shortcode handlers accept user-controlled input but fail to sanitize it before storage and fail to escape it on output. Avada (Fusion) Builder (CPE: cpe:2.3:a:themefusion:avada_(fusion)_builder:*:*:*:*:*:*:*:*) is a widely deployed page-builder and theme framework for WordPress developed by ThemeFusion. Its Dynamic Data feature pulls stored user attributes - including user biographical fields - and renders them inline within page content. Because WordPress allows subscribers to edit their own profile fields (e.g., 'Biographical Info'), this mechanism becomes the injection vector: an attacker writes a script payload into a profile field that a vulnerable shortcode later outputs unescaped. The CVSS Changed Scope reflects that the injected payload runs in a different browsing context (the administrator's session) than the one that submitted it.
RemediationAI
The primary remediation is to update the Avada (Fusion) Builder plugin to a version beyond 3.15.2 immediately. The exact patched version is not independently confirmed from the available intelligence data - consult the official Avada changelog at https://avada.com/documentation/avada-changelog/ and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/72a6b040-ed02-4561-82f2-4adb820bdf7d?source=cve to confirm the minimum safe version before updating. As an interim compensating control for sites that cannot patch immediately, disable open user registration to prevent unauthenticated individuals from creating subscriber accounts, which removes the primary attacker entry point; note this does not protect against already-registered low-privilege users. Additionally, review and sanitize existing user biographical fields in the WordPress database for any sites that have had open registration, as stored payloads persist until removed even after patching.
More in Avada Fusion Builder
View allArbitrary file deletion in the Avada (Fusion) Builder WordPress plugin through version 3.15.3 allows remote unauthentica
Unauthenticated arbitrary file write in the Avada WordPress theme (versions up to and including 7.16) combined with the
Unauthenticated remote code execution in the Avada Builder (fusion-builder) WordPress plugin versions up to and includin
Time-based SQL injection in Avada Builder for WordPress allows remote unauthenticated attackers to extract sensitive dat
Arbitrary file read in Avada Builder plugin for WordPress versions up to 3.15.2 allows authenticated attackers with Subs
Stored Cross-Site Scripting in the Avada (Fusion) Builder WordPress plugin through version 3.15.6 allows authenticated c
Stored Cross-Site Scripting in the Avada (Fusion) Builder WordPress plugin versions up to 3.15.5 allows authenticated co
Arbitrary WordPress action execution in Avada (Fusion) Builder plugin versions up to 3.15.1 allows authenticated attacke
Avada (Fusion) Builder plugin for WordPress up to version 3.15.1 allows authenticated Subscriber-level users and above t
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today