Avada (Fusion) Builder: Stored Cross-Site Scripting (CVE-2026-84938)

The Avada (Fusion) Builder plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability (CVE-2026-84938) affecting versions 3.16.1 and earlier. The flaw arises from inadequate input sanitization and output escaping within the Form Notification Dynamic-Data functionality. An unauthenticated attacker can leverage this to inject malicious web scripts that execute within the context of a user session when viewing pages containing affected Post Cards elements.

Impact

Successful exploitation results in arbitrary script execution in the browser of users viewing pages where the malicious payload is rendered. This can lead to session hijacking, unauthorized actions performed on behalf of the user, or defacement. Exploitation requires specific site configurations: the target must have a Fusion Form embedded on an admin-authored page and a Post Cards element configured to display attachment post types on a publicly accessible page.

Recommendation

• Update the Avada (Fusion) Builder plugin to a version beyond 3.16.1 immediately to resolve the sanitization and escaping issues.
• Review WordPress site configurations to identify pages using the Fusion Form notification dynamic data hook combined with Post Cards elements.
• Monitor WordPress web access logs for unusual POST requests targeting form notification handling endpoints, specifically looking for injection attempts in payload parameters.