Avada WordPress Theme EUVD-2026-91174

Exploitation requires that the target site run the Avada theme version 7.16.1 or earlier and that a victim with access to the post editor (typically an authenticated contributor/author/editor/administrator) be tricked into clicking an attacker-crafted link carrying a malicious 'lang' query parameter. The payload only executes when the reflected value reaches the post-editor metabox href attribute, so the victim must navigate to/render that editor context. Limiting factors: the attack is reflected (not stored/persistent), so it is per-link and non-automatable against the server; it requires user interaction (UI:R) and successful social engineering; and impact is confined to the victim's browser security context rather than direct server compromise. No special server-side configuration toggle is named in the description beyond running the affected theme version.

This is a reflected Cross-Site Scripting flaw (CWE-79) with a CVSS 3.1 base score of 6.1 (Medium). The provided vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N indicates a network-reachable, low-complexity, unauthenticated attack that nevertheless requires user interaction (victim must click a crafted link), with a changed scope and limited confidentiality/integrity impact and no availability impact - a signal profile entirely consistent with reflected XSS. No EPSS score was supplied, the CVE is NOT on the CISA KEV list, and no public proof-of-concept is indicated in the sources, so exploitation status is 'no public exploit identified at time of analysis.' The absence of KEV/EPSS/POC signals, combined with the mandatory user-interaction requirement, makes this a real but moderate-priority issue rather than an urgent mass-exploitation threat: it cannot be automated against servers directly and depends on social engineering of an individual victim. There is no conflict between the CVSS vector and the description - both describe unauthenticated, network-delivered, user-interaction-dependent reflected XSS. Priority rises for sites running the affected Avada versions given the theme's very large install base, but the technical ceiling (session/credential theft within the victim's browser context, not server compromise) should temper urgency.

An attacker crafts a URL pointing at a vulnerable Avada site with a malicious script embedded in the 'lang' parameter and sends it to a logged-in administrator or editor via phishing. When the victim clicks the link and the value is echoed unescaped into the href attribute of the post-editor metabox, the injected JavaScript executes in the victim's authenticated browser session, enabling session/cookie theft or actions on their behalf. No public exploit code is identified at time of analysis, and successful exploitation hinges on the victim clicking the attacker-supplied link.