Stored Cross-Site Scripting in Avada Builder Plugin for WordPress

CVE-2025-1665

What is CVE-2025-1665?

The Avada (Fusion) Builder plugin for WordPress exhibits a vulnerability that allows for Stored Cross-Site Scripting through its shortcodes. This issue stems from inadequate input sanitization and output escaping related to user-supplied attributes. Authenticated users with contributor-level access or higher can exploit this vulnerability to inject arbitrary web scripts. These scripts will execute whenever a user accesses the compromised page, which poses a serious risk to website security and user data.

References