Avada Theme CVE-2026-97340

Requires an authenticated account with Subscriber-level access or above (satisfied automatically on sites allowing open user registration). Exploitation is NOT fully automatic: a victim must navigate to the attacker's author archive page AND actively click the injected social icon, and the site must have the Avada 'Open Social Icons in a New Window' option set to Off so the browser does not block the javascript: URL from opening in a new tab. Affects Avada | Website Builder for WordPress & WooCommerce versions up to and including 7.16.1; these user-interaction and configuration dependencies meaningfully limit realistic exploitation despite the network attack vector.

This is a moderate-severity, authenticated stored XSS (CVSS 6.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) that does not rise to an emergency-priority issue. Several signals point to limited real-world risk: no public exploit was identified at time of analysis (no POC claimed by Wordfence), there is no CISA KEV listing (so no confirmed active exploitation), and no EPSS score was provided in the input to gauge exploitation probability. The requirement for an authenticated Subscriber+ account (PR:L) lowers the barrier only slightly because WordPress sites that permit self-registration give any visitor a Subscriber account, but exploitation is further gated by real-world conditions the CVSS score understates. Note a clear conflict in the supplied data: the CVSS vector encodes UI:N (no user interaction) yet the description explicitly states 'a click is required' and that the site must have 'Open Social Icons in a New Window' set to Off - this means the official vector likely overstates exploitability and the practical score should reflect UI:R. The partial confidentiality/integrity impact (C:L/I:L) with scope change (S:C) is consistent with session-scoped script execution in a victim's browser rather than full account or server compromise. Net: a legitimate issue worth patching on a normal cadence, not a drop-everything priority, absent evidence of exploitation.

An attacker registers (or uses) a Subscriber-level account on an Avada-powered WordPress site and sets one of their profile social-link contact fields (e.g. author_twitter) to a javascript: URL. When a visitor browses that user's author archive page and clicks the rendered social icon - and only if the site has 'Open Social Icons in a New Window' disabled - the injected script executes in the visitor's browser session. No public proof-of-concept exploit was identified at time of analysis.