Avada Core CVE-2026-32454

Multi-signal risk analysis reveals a LOW-to-MODERATE priority despite moderate CVSS score: (1) CVSS 6.5 (Medium) indicates broad attack surface (AV:N/AC:L) but is tempered by authentication requirement (PR:L) and user interaction dependency (UI:R), limiting actual impact scope; (2) EPSS 0.03% (8th percentile) indicates minimal observed exploitation activity in the wild, contradicting the moderate CVSS—this signal is most predictive of actual risk; (3) No KEV (Known Exploited Vulnerability) listing from CISA suggests no active weaponization; (4) Patchstack as sole reporter (not a CISA/NVD primary source) suggests limited visibility in widespread exploit toolkits; (5) Attack requires PR:L (low privilege user) + UI:R (user click), making opportunistic mass exploitation difficult. SSVC assessment: Exploitation likelihood is Low (no public POC referenced, EPSS confirms low activity), automatable impact is Low (requires user interaction), technical impact is Moderate (XSS can compromise session/data). Recommendation: Patch within standard maintenance windows; not a critical/emergency priority.

An attacker with a low-privilege WordPress account (e.g., Contributor or Author role) crafts a malicious input containing JavaScript payload and injects it into a fusioncore component (e.g., theme option field, page builder element, custom post meta). When an administrator or other user visits the affected page and interacts with the vulnerable element (e.g., hovers, clicks, edits), the JavaScript executes in their browser session, potentially allowing the attacker to: steal session cookies/authentication tokens, redirect to phishing sites, deface content, or escalate privileges. No public POC is referenced in available sources, and the low EPSS score suggests active exploitation is minimal, reducing real-world threat likelihood.