{"id":"CVE-2026-84938","kind":"vulnerability","aliases":["CVE-2026-84938"],"related":[],"title":"Avada Builder WordPress plugin: stored script injection through form notifications","description":"The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Form Notification Dynamic-Data action_hook → Media Upload Chain (ID3 Metadata / html_attributes) in all versions up to, and including, 3.16.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that a Fusion Form is embedded on an admin-authored page (granting manage_options context to the Dynamic Data action hook callback), and that a Post Cards element configured to display attachment post types is present on a publicly accessible page so the planted shortcode payload is rendered.","summary":"The Avada (Fusion) Builder plugin for WordPress lets an unauthenticated attacker store a script through a media upload chain that a form notification later outputs. The script runs in the browser of any visitor who opens an affected page, which can hijack administrator sessions.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["avada","fusion-builder","package","self-hosted","wordpress"],"not_affected_if":["default-config","no-fusion-forms"],"how_to_check":"- Check the installed Avada (Fusion) Builder version in the WordPress plugins screen or `wp plugin get fusion-builder --field=version`\n- Look for a Fusion Form on an admin-authored page and a Post Cards element that shows attachment post types on a public page","fix":"- Avada (Fusion) Builder: move to a version later than `3.16.1`; the exact fixed version is unknown from the sources","status":"open","published_at":"2026-11-10T07:16:52+00:00","first_seen_at":"2026-11-10T07:20:33+00:00","triaged_at":"2026-11-10T07:21:05+00:00","updated_at":"2026-11-10T07:21:05+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-10T07:21:05Z","model":"claude-haiku-5-5","output":{"fix":"- Avada (Fusion) Builder: move to a version later than `3.16.1`; the exact fixed version is unknown from the sources","reach":"internet","title":"Avada Builder WordPress plugin: stored script injection through form notifications","impact":"medium","summary":"The Avada (Fusion) Builder plugin for WordPress lets an unauthenticated attacker store a script through a media upload chain that a form notification later outputs. The script runs in the browser of any visitor who opens an affected page, which can hijack administrator sessions.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","avada","fusion-builder","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Injected script runs in visitors' browsers and can hijack admin sessions","analyst_note":"Confirm the fixed version after 3.16.1 from the NVD or vendor advisory; the sources give none.","how_to_check":"- Check the installed Avada (Fusion) Builder version in the WordPress plugins screen or `wp plugin get fusion-builder --field=version`\n- Look for a Fusion Form on an admin-authored page and a Post Cards element that shows attachment post types on a public page","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-fusion-forms","default-config"],"who_is_affected":"Sites running Avada (Fusion) Builder up to and including 3.16.1 are exposed when a Fusion Form is embedded on an admin-authored page and a Post Cards element showing attachments appears on a public page. Sites without Fusion Forms or without a Post Cards element on public pages are unlikely to be exposed. Sites on newer versions than 3.16.1 are outside the stated range.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000805,"input_tokens":4723,"output_tokens":665,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-84938':13A,16A '3.16.1':107C 'access':136C,182C 'action':91C,162C 'admin':151C 'admin-author':150C 'administr':68B 'affect':63B 'arbitrari':125C 'attach':174C 'attack':36B,122C 'attribut':99C 'author':152C 'avada':1A,17B,27B,71C 'browser':56B 'builder':2A,20B,29B,73C 'callback':164C 'card':169C 'chain':44B,95C 'configur':171C 'context':157C 'cross':82C 'cross-sit':81C 'cve':11A,14A 'data':90C,161C 'display':173C 'due':108C 'dynam':89C,160C 'dynamic-data':88C 'element':170C 'embed':147C 'escap':115C 'execut':132C 'exploit':140C 'form':9A,47B,86C,145C 'fusion':19B,28B,72C,144C 'fusion-build':18B 'grant':154C 'hijack':67B 'hook':92C,163C 'host':24B 'html':98C 'id3':96C 'includ':106C 'inject':7A,124C,138C 'input':111C 'insuffici':110C 'later':49B 'let':33B 'make':117C 'manag':155C 'media':42B,93C 'metadata':97C 'notif':10A,48B,87C 'open':61B 'option':156C 'output':50B,114C 'packag':21B 'page':64B,129C,139C,153C,183C 'payload':188C 'plant':186C 'plugin':4A,30B,74C 'possibl':119C 'post':168C,175C 'present':178C 'public':181C 'render':190C 'requir':141C 'run':53B 'sanit':112C 'script':6A,39B,52B,84C,127C 'self':23B 'self-host':22B 'session':69B 'shortcod':187C 'site':83C 'store':5A,37B,80C 'type':176C 'unauthent':35B,121C 'upload':43B,94C 'user':135C 'version':102C 'via':85C 'visitor':59B 'vulner':78C 'web':126C 'whenev':133C 'wordpress':3A,25B,32B,76C","nicknames":[],"mitigations":[],"who_affected":"Sites running Avada (Fusion) Builder up to and including 3.16.1 are exposed when a Fusion Form is embedded on an admin-authored page and a Post Cards element showing attachments appears on a public page. Sites without Fusion Forms or without a Post Cards element on public pages are unlikely to be exposed. Sites on newer versions than 3.16.1 are outside the stated range.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["avada","fusionbuilder","high","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-2026':12A,15A '-84938':13A,16A 'avada':1A 'builder':2A 'cve':11A,14A 'form':9A 'inject':7A 'notif':10A 'plugin':4A 'script':6A 'store':5A 'wordpress':3A","search_b":"'administr':68B 'affect':63B 'attack':36B 'avada':17B,27B 'browser':56B 'builder':20B,29B 'chain':44B 'form':47B 'fusion':19B,28B 'fusion-build':18B 'hijack':67B 'host':24B 'later':49B 'let':33B 'media':42B 'notif':48B 'open':61B 'output':50B 'packag':21B 'page':64B 'plugin':30B 'run':53B 'script':39B,52B 'self':23B 'self-host':22B 'session':69B 'store':37B 'unauthent':35B 'upload':43B 'visitor':59B 'wordpress':25B,32B","search_c":"'3.16.1':107C 'access':136C,182C 'action':91C,162C 'admin':151C 'admin-author':150C 'arbitrari':125C 'attach':174C 'attack':122C 'attribut':99C 'author':152C 'avada':71C 'builder':73C 'callback':164C 'card':169C 'chain':95C 'configur':171C 'context':157C 'cross':82C 'cross-sit':81C 'data':90C,161C 'display':173C 'due':108C 'dynam':89C,160C 'dynamic-data':88C 'element':170C 'embed':147C 'escap':115C 'execut':132C 'exploit':140C 'form':86C,145C 'fusion':72C,144C 'grant':154C 'hook':92C,163C 'html':98C 'id3':96C 'includ':106C 'inject':124C,138C 'input':111C 'insuffici':110C 'make':117C 'manag':155C 'media':93C 'metadata':97C 'notif':87C 'option':156C 'output':114C 'page':129C,139C,153C,183C 'payload':188C 'plant':186C 'plugin':74C 'possibl':119C 'post':168C,175C 'present':178C 'public':181C 'render':190C 'requir':141C 'sanit':112C 'script':84C,127C 'shortcod':187C 'site':83C 'store':80C 'type':176C 'unauthent':121C 'upload':94C 'user':135C 'version':102C 'via':85C 'vulner':78C 'web':126C 'whenev':133C 'wordpress':76C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T07:16:52+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-84938","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84938","severity":null,"published_at":"2026-11-10T07:16:52+00:00","modified_at":"2026-11-10T07:16:53+00:00","first_seen_at":"2026-11-10T07:20:33+00:00","fetched_at":"2026-11-10T07:20:33+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}