Stored Cross-Site Scripting in Avada Theme for WordPress

CVE-2020-36711

Summary

The Avada theme for WordPress is susceptible to Stored Cross-Site Scripting through the update_layout function, as found in versions up to and including 6.2.3. This vulnerability arises from inadequate input sanitization and output escaping, allowing attackers with contributor-level access and above to inject malicious web scripts into pages. The compromised pages may execute the injected scripts in the browsers of unsuspecting users, leading to potential data theft or further exploitation.

References