CVE-2026-84938 · Package
NO FIX YET · SEE WHAT TO DO
The Avada (Fusion) Builder plugin for WordPress lets an unauthenticated attacker store a script through a media upload chain that a form notification later outputs. The script runs in the browser of any visitor who opens an affected page, which can hijack administrator sessions.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running Avada (Fusion) Builder up to and including 3.16.1 are exposed when a Fusion Form is embedded on an admin-authored page and a Post Cards element showing attachments appears on a public page. Sites without Fusion Forms or without a Post Cards element on public pages are unlikely to be exposed. Sites on newer versions than 3.16.1 are outside the stated range.
Not affected if default-config, no-fusion-forms
Who cares avada, fusion-builder, self-hosted, wordpress
wp plugin get fusion-builder --field=version3.16.1; the exact fixed version is unknown from the sourcesThe Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Form Notification Dynamic-Data action_hook → Media Upload Chain (ID3 Metadata / html_attributes) in all versions up to, and including, 3.16.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that a Fusion Form is embedded on an admin-authored page (granting manage_options context to the Dynamic Data action hook callback), and that a Post Cards element configured to display attachment post types is present on a publicly accessible page so the planted shortcode payload is rendered.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.