CVE-2026-104729
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tab_index, empty_notice' parameter in all versions up to, and including, 3.16.2 due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts into pages that execute whenever a user accesses an injected page. wp_kses_post does not strip the payload on save because the dangerous characters reside within shortcode attribute text between square brackets, which kses treats as plain text rather than HTML markup.
Risk Assessment
An attacker with a contributor account can persistently infect site pages with a malicious script that runs in visitors' browsers, including administrators, enabling session theft or account takeover. The risk applies to sites with multiple authors or open registration.
Recommendation
Update the Avada (Fusion) Builder plugin to a version later than 3.16.2 as soon as it is available, and restrict contributor privileges to trusted users. Until patched, consider disabling or limiting content publishing by low-privilege users.
Other vulnerabilities in Avada (Fusion) Builder
See all- CVE-2026-97670Critical
The Avada (Fusion) Builder plugin for WordPress up to version 7.16.1 contains an authorization bypass vulnerability. An unauthenticated attacker can invoke arbitrary WordPress action hooks by sending a crafted request to the public form-submit endpoint, potentially leading to permanent deletion of content (posts, pages, comments) or other state changes.
- CVE-2026-97471Medium
The Avada (Fusion) Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 3.16.1 via the 'args[link_target]' parameter. Unauthenticated attackers can extract arbitrary user meta values for any user ID, including administrator email addresses, login names, wp_user_level, and WooCommerce customer PII such as billing_email, billing_phone, and billing_address_1.
- CVE-2026-16654Medium
The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'size' Shortcode Attribute in all versions up to, and including, 3.15.6 due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or above can inject arbitrary web scripts that execute whenever a user accesses an injected page.
- CVE-2026-12536Medium
The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Module Title' parameter in all versions up to and including 3.15.5 due to insufficient input sanitization and output escaping.
- CVE-2026-1543Medium
The Avada (Fusion) Builder plugin for WordPress up to version 3.15.2 is vulnerable to stored XSS via multiple shortcodes due to insufficient input sanitization and output escaping.
Original NVD description (English source)
The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tab_index, empty_notice' parameter in all versions up to, and including, 3.16.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. wp_kses_post does not strip the payload on save because the dangerous characters reside within shortcode attribute text between square brackets, which kses treats as plain text rather than HTML markup.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS