CPE
The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting due to insufficient input sanitization in Form Notification dynamic data handling, allowing unauthenticated attackers to execute arbitrary scripts when victims view rendered Post Card elements.