{"id":"CVE-2026-104729","kind":"vulnerability","aliases":["CVE-2026-104729"],"related":[],"title":"Avada Fusion Builder WordPress plugin: stored XSS via shortcode attributes","description":"The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tab_index, empty_notice' parameter in all versions up to, and including, 3.16.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. wp_kses_post does not strip the payload on save because the dangerous characters reside within shortcode attribute text between square brackets, which kses treats as plain text rather than HTML markup.","summary":"The Avada (Fusion) Builder WordPress plugin up to and including 3.16.2 fails to sanitize the tab_index and empty_notice parameters. An authenticated contributor can save a script that runs in the browser of anyone who opens the injected page.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["avada","fusion-builder","package","self-hosted","wordpress"],"not_affected_if":["no-contributor-accounts","plugin-newer-than-3.16.2","plugin-not-installed"],"how_to_check":"- Check the installed Avada or Fusion Builder plugin version in the WordPress admin under Plugins; `3.16.2` and earlier are affected per the sources.\n- Search page content for shortcodes using tab_index or empty_notice attributes containing script tags.","fix":"- Update the Avada (Fusion) Builder plugin to a version newer than `3.16.2`; the fixed version is unknown from the sources.\n- Until patched, limit contributor-level accounts and review pages that were edited by them.","status":"open","published_at":"2026-10-28T07:16:43+00:00","first_seen_at":"2026-10-28T07:31:37+00:00","triaged_at":"2026-10-28T07:33:11+00:00","updated_at":"2026-10-28T07:33:11+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-28T07:33:11Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Avada (Fusion) Builder plugin to a version newer than `3.16.2`; the fixed version is unknown from the sources.\n- Until patched, limit contributor-level accounts and review pages that were edited by them.","reach":"internet","title":"Avada Fusion Builder WordPress plugin: stored XSS via shortcode attributes","impact":"medium","summary":"The Avada (Fusion) Builder WordPress plugin up to and including 3.16.2 fails to sanitize the tab_index and empty_notice parameters. An authenticated contributor can save a script that runs in the browser of anyone who opens the injected page.","category":"package","nicknames":[],"who_cares":["wordpress","avada","fusion-builder","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Script runs in visitors' and admins' browsers, enabling session theft or actions as them.","analyst_note":"Find the fixed Avada Fusion Builder version and confirm the vendor advisory; the NVD entry alone does not give it.","how_to_check":"- Check the installed Avada or Fusion Builder plugin version in the WordPress admin under Plugins; `3.16.2` and earlier are affected per the sources.\n- Search page content for shortcodes using tab_index or empty_notice attributes containing script tags.","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-newer-than-3.16.2","no-contributor-accounts"],"who_is_affected":"Sites running the Avada (Fusion) Builder plugin at version 3.16.2 or earlier where contributor-level or higher users can edit pages built with the builder. Exposure requires an account with at least contributor access; sites without the plugin or with only trusted editors are lower risk. The sources do not say whether default configurations are vulnerable beyond this.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000683,"input_tokens":3440,"output_tokens":678,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-104729':13A,16A '-2026':12A,15A '3.16.2':36B,95C 'access':115C,131C 'anyon':60B 'arbitrari':120C 'attack':110C 'attribut':10A,152C 'authent':48B,109C 'avada':1A,17B,27B,67C 'bracket':156C 'browser':58B 'builder':3A,20B,29B,69C 'charact':148C 'contributor':49B,113C 'contributor-level':112C 'cross':78C 'cross-sit':77C 'cve':11A,14A 'danger':147C 'due':96C 'empti':44B,85C 'escap':103C 'execut':127C 'fail':37B 'fusion':2A,19B,28B,68C 'fusion-build':18B 'host':24B 'html':165C 'includ':35B,94C 'index':42B,84C 'inject':64B,119C,133C 'input':99C 'insuffici':98C 'kses':136C,158C 'level':114C 'make':105C 'markup':166C 'notic':45B,86C 'open':62B 'output':102C 'packag':21B 'page':65B,124C,134C 'paramet':46B,87C 'payload':142C 'plain':161C 'plugin':5A,31B,70C 'possibl':107C 'post':137C 'rather':163C 'resid':149C 'run':55B 'sanit':39B,100C 'save':51B,144C 'script':53B,80C,122C 'self':23B 'self-host':22B 'shortcod':9A,151C 'site':79C 'squar':155C 'store':6A,76C 'strip':140C 'tab':41B,83C 'text':153C,162C 'treat':159C 'user':130C 'version':90C 'via':8A,81C 'vulner':74C 'web':121C 'whenev':128C 'within':150C 'wordpress':4A,25B,30B,72C 'wp':135C 'xss':7A","nicknames":[],"mitigations":[],"who_affected":"Sites running the Avada (Fusion) Builder plugin at version 3.16.2 or earlier where contributor-level or higher users can edit pages built with the builder. Exposure requires an account with at least contributor access; sites without the plugin or with only trusted editors are lower risk. The sources do not say whether default configurations are vulnerable beyond this.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T07:16:43+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-104729","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104729","severity":null,"published_at":"2026-10-28T07:16:43+00:00","modified_at":"2026-10-28T07:16:43+00:00","first_seen_at":"2026-10-28T07:31:37+00:00","fetched_at":"2026-10-28T07:31:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}