What is the CVSS score of CVE-2026-32454?

CVE-2026-32454 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Avada Core are affected by CVE-2026-32454?

CVE-2026-32454 presents notable security risk, a cross-site scripting vulnerability rated CVSS 6.5. Attackers could inject scripts to steal sessions or perform actions as authenticated users.. A patch is available.

How to fix or mitigate CVE-2026-32454?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

Avada Core CVE-2026-32454

EUVD-2026-12007 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-13 Patchstack

XSS Avada Core

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

5.15.0

EUVD ID Assigned

Mar 13, 2026 - 16:57 euvd

EUVD-2026-12007

Analysis Generated

Mar 13, 2026 - 16:57 vuln.today

CVE Published

Mar 13, 2026 - 11:42 nvd

MEDIUM 6.5

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeFusion Avada Core fusion-core allows DOM-Based XSS.This issue affects Avada Core: from n/a through < 5.15.0.

AnalysisAI

A DOM-based Cross-Site Scripting (XSS) vulnerability exists in ThemeFusion Avada Core plugin versions prior to 5.15.0, allowing authenticated users with low privileges to inject malicious scripts that execute in other users' browsers. The vulnerability requires user interaction (UI:R) and affects the confidentiality, integrity, and availability of affected WordPress installations. With an EPSS score of 0.03% (8th percentile), real-world exploitation probability is currently low, though the vulnerability is documented and patched.

Technical ContextAI

This vulnerability is a DOM-based XSS (CWE-79: Improper Neutralization of Input During Web Page Generation) within the fusion-core plugin (CPE: cpe:2.3:a:themefusion:avada_core:*:*:*:*:*:*:*:*), a WordPress theme framework component developed by ThemeFusion. DOM-based XSS occurs when untrusted user input is processed by client-side JavaScript and rendered into the DOM without proper sanitization or encoding. Unlike reflected/stored XSS, DOM-based XSS flows entirely within the browser and may bypass server-side security controls. The vulnerability affects versions from an unspecified baseline through version 5.14.x, with remediation available in 5.15.0 and later. The root cause involves improper handling of user-controlled input in JavaScript code that directly manipulates the DOM.

RemediationAI

vendor_patch: Update Avada Core (fusion-core) plugin to version 5.15.0 or later; method: WordPress admin dashboard: Plugins > Updates > Update Avada Core, or manual download from Patchstack/ThemeFusion; priority: Standard (within 30 days of next maintenance window) workaround: If immediate patching is not possible, restrict plugin access to trusted administrators only via user role management; disable user-facing theme customization features if affected functionality identified detection: Monitor WordPress admin audit logs for suspicious script injection attempts; scan site via security plugins for XSS payloads in post content/settings