---
id: "CVE-2026-84938"
page: "https://infrastack.ai/live/CVE-2026-84938"
kind: "vulnerability"
aliases: ["CVE-2026-84938"]
title: "Avada Builder WordPress plugin: stored script injection through form notifications"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["avada", "fusion-builder", "package", "self-hosted", "wordpress"]
not_affected_if: ["default-config", "no-fusion-forms"]
published_at: "2026-11-10T07:16:52+00:00"
first_seen_at: "2026-11-10T07:20:33+00:00"
updated_at: "2026-11-10T07:21:05+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84938", "first_seen_at": "2026-11-10T07:20:33+00:00"}]
exploit_sources: []
---

# Avada Builder WordPress plugin: stored script injection through form notifications

Link for people: https://infrastack.ai/live/CVE-2026-84938 (this .md is for agents)

The Avada (Fusion) Builder plugin for WordPress lets an unauthenticated attacker store a script through a media upload chain that a form notification later outputs. The script runs in the browser of any visitor who opens an affected page, which can hijack administrator sessions.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Avada (Fusion) Builder version in the WordPress plugins screen or `wp plugin get fusion-builder --field=version`
- Look for a Fusion Form on an admin-authored page and a Post Cards element that shows attachment post types on a public page

## Fix

- Avada (Fusion) Builder: move to a version later than `3.16.1`; the exact fixed version is unknown from the sources

## Timeline

- 2026-11-10T07:20:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-84938

## From the sources

The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Form Notification Dynamic-Data action_hook → Media Upload Chain (ID3 Metadata / html_attributes) in all versions up to, and including, 3.16.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that a Fusion Form is embedded on an admin-authored page (granting manage_options context to the Dynamic Data action hook callback), and that a Post Cards element configured to display attachment post types is present on a publicly accessible page so the planted shortcode payload is rendered.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_