{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3athemefusionavada_builderwordpress/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:themefusion:avada_builder:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-84938"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Avada (Fusion) Builder (\u003c= 3.16.1)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["ThemeFusion"],"content_html":"\u003cp\u003eThe Avada (Fusion) Builder plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability (CVE-2026-84938) affecting versions 3.16.1 and earlier. The flaw arises from inadequate input sanitization and output escaping within the Form Notification Dynamic-Data functionality. An unauthenticated attacker can leverage this to inject malicious web scripts that execute within the context of a user session when viewing pages containing affected Post Cards elements.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in arbitrary script execution in the browser of users viewing pages where the malicious payload is rendered. This can lead to session hijacking, unauthorized actions performed on behalf of the user, or defacement. Exploitation requires specific site configurations: the target must have a Fusion Form embedded on an admin-authored page and a Post Cards element configured to display attachment post types on a publicly accessible page.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the Avada (Fusion) Builder plugin to a version beyond 3.16.1 immediately to resolve the sanitization and escaping issues.\u003c/li\u003e\n\u003cli\u003eReview WordPress site configurations to identify pages using the Fusion Form notification dynamic data hook combined with Post Cards elements.\u003c/li\u003e\n\u003cli\u003eMonitor WordPress web access logs for unusual POST requests targeting form notification handling endpoints, specifically looking for injection attempts in payload parameters.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-10T10:06:04Z","date_published":"2026-11-10T10:06:04Z","id":"https://feed.craftedsignal.io/briefs/2026-11-avada-builder-xss/","summary":"The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting due to insufficient input sanitization in Form Notification dynamic data handling, allowing unauthenticated attackers to execute arbitrary scripts when victims view rendered Post Card elements.","title":"Avada (Fusion) Builder: Stored Cross-Site Scripting (CVE-2026-84938)","url":"https://feed.craftedsignal.io/briefs/2026-11-avada-builder-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:themefusion:avada_builder:*:*:*:*:*:wordpress:*:*","version":"https://jsonfeed.org/version/1.1"}