Stored Cross-Site Scripting Vulnerability in Avada Fusion Builder Plugin for WordPress

CVE-2026-84938

What is CVE-2026-84938?

The Avada Fusion Builder plugin for WordPress suffers from a Stored Cross-Site Scripting vulnerability due to lack of proper input sanitization and output escaping in the Form Notification Dynamic-Data action hook. This vulnerability affects all versions up to and including 3.16.1, allowing unauthenticated attackers to inject arbitrary web scripts into pages. When users access an affected page, these scripts execute, potentially compromising user data and site integrity. To exploit this vulnerability, an attacker must embed a Fusion Form on an admin-authored page and include a Post Cards element configured to display specific attachment post types. This setup facilitates the execution of malicious scripts through shortcodes in a publicly accessible context.

References