What is the CVSS score of CVE-2026-1543?

CVE-2026-1543 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Avada Fusion Builder CVE-2026-1543

EUVD-2026-31211 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-21 Wordfence

GHSA-c7gm-xj5j-p869

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 21, 2026 - 05:13 vuln.today

DescriptionCVE.org

The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcodes in all versions up to, and including, 3.15.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user (typically an administrator) accesses a page displaying dynamic user data (such as via the Dynamic Data feature pulling user biographical information).

AnalysisAI

Stored Cross-Site Scripting in Avada (Fusion) Builder for WordPress (all versions through 3.15.2) allows authenticated attackers with Subscriber-level access to persist malicious JavaScript via unsanitized shortcode parameters. The injected scripts execute in the browser of any user - typically an administrator - who views a page rendering dynamic user data such as biographical information sourced through the plugin's Dynamic Data feature. With CVSS Scope set to Changed (S:C), successful exploitation crosses the victim's security boundary, enabling session hijacking or privilege escalation against higher-privileged users. No public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation) describes the root cause: the plugin's shortcode handlers accept user-controlled input but fail to sanitize it before storage and fail to escape it on output. Avada (Fusion) Builder (CPE: cpe:2.3:a:themefusion:avada_(fusion)_builder:*:*:*:*:*:*:*:*) is a widely deployed page-builder and theme framework for WordPress developed by ThemeFusion. Its Dynamic Data feature pulls stored user attributes - including user biographical fields - and renders them inline within page content. Because WordPress allows subscribers to edit their own profile fields (e.g., 'Biographical Info'), this mechanism becomes the injection vector: an attacker writes a script payload into a profile field that a vulnerable shortcode later outputs unescaped. The CVSS Changed Scope reflects that the injected payload runs in a different browsing context (the administrator's session) than the one that submitted it.

RemediationAI

The primary remediation is to update the Avada (Fusion) Builder plugin to a version beyond 3.15.2 immediately. The exact patched version is not independently confirmed from the available intelligence data - consult the official Avada changelog at https://avada.com/documentation/avada-changelog/ and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/72a6b040-ed02-4561-82f2-4adb820bdf7d?source=cve to confirm the minimum safe version before updating. As an interim compensating control for sites that cannot patch immediately, disable open user registration to prevent unauthenticated individuals from creating subscriber accounts, which removes the primary attacker entry point; note this does not protect against already-registered low-privilege users. Additionally, review and sanitize existing user biographical fields in the WordPress database for any sites that have had open registration, as stored payloads persist until removed even after patching.