Stored Cross-Site Scripting Vulnerability in Avada Builder Plugin for WordPress

CVE-2026-12536

What is CVE-2026-12536?

The Avada (Fusion) Builder plugin for WordPress is affected by a Stored Cross-Site Scripting vulnerability, primarily due to inadequate input sanitization and output escaping within the ‘Module Title’ parameter. This flaw allows authenticated attackers with Contributor-level access and above to inject malicious scripts into web pages. When users visit these compromised pages, the injected scripts execute, potentially leading to unauthorized actions or data theft. It is crucial for users of the plugin to ensure they are running the latest version to mitigate these security risks.

References