Avada Fusion Builder CVE-2026-16654

Exploitation requires the attacker to hold a valid WordPress account with at minimum contributor-level role on the target site. The vulnerable condition is the Avada (Fusion) Builder plugin being active and the 'size' shortcode attribute being reachable through the contributor's post-editing interface. No non-default server configuration is required beyond having the plugin installed and enabled. Exploitation is limited by the contributor-role prerequisite - sites that restrict registration or maintain tight control over contributor accounts reduce exposure significantly. The impact is further bounded by requiring a privileged user (e.g., admin or editor) to subsequently visit the injected page for the stored payload to execute in a high-value session context.

The CVSS 6.4 score reflects a meaningful but not critical risk profile: network-accessible (AV:N), low complexity (AC:L), low-privilege entry point (PR:L requiring only contributor access), and Scope:Changed (S:C) with low confidentiality and integrity impact. The Scope:Changed designation is the most significant factor - a contributor account can affect administrator sessions if an admin visits an injected page, potentially enabling privilege escalation or session hijacking beyond what the base score implies. No EPSS score was provided in the available intelligence, and the absence of a CISA KEV listing or confirmed POC means this is not currently a fire-drill priority for most organizations, though the contributed-user attack surface is broad on multi-author WordPress installations. The provided CVSS vector sets UI:N, which is technically debatable for stored XSS - a victim must still navigate to the injected page, suggesting UI:R may be more precise; this discrepancy is flagged in the assessed vector below. Overall, any multi-author WordPress site running Avada Builder through 3.15.6 where untrusted contributors exist carries real exposure, and patching should be treated as a routine but prompt maintenance task.

An attacker registers or compromises a contributor-level account on a WordPress site running Avada Builder through 3.15.6, then creates or edits a page embedding a crafted 'size' shortcode attribute containing a JavaScript event handler payload. When a site administrator reviews or visits the published page, the stored script executes in the administrator's browser session, potentially allowing the attacker to exfiltrate the admin's authentication cookies, perform actions on the administrator's behalf, or create a new privileged account. No public proof-of-concept code is confirmed at time of analysis, but the bypass technique (shortcode attribute kses evasion) is well-documented in the WordPress security research community and replication is low-effort for knowledgeable actors.