CVE-2025-58922

The Avada theme for WordPress up to version 7.16 is vulnerable to Arbitrary File Write when the Fusion Builder plugin is installed and active in versions up to 3.16. A chain of authorization and input validation weaknesses allows unauthenticated attackers to write attacker-controlled files to the server, leading to remote code execution and complete site compromise. Successful exploitation requires both Avada and Fusion Builder installed and active, as well as certain administrator-authored content.

The Avada theme for WordPress and WooCommerce is vulnerable to Stored Cross-Site Scripting via user profile 'Author Page' social link contact-method fields (author_facebook, author_twitter, author_linkedin, author_dribble, author_whatsapp, author_email) in versions up to and including 7.16.1. These fields are emitted in an anchor href without rejecting dangerous URL schemes such as javascript:.

The Avada theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'lang' parameter in all versions up to and including 7.16.1 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute if they can trick a user into clicking a link.