CVE-2025-49940
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
Fusion Builder up to version 3.13.2 contains a DOM-Based XSS vulnerability due to improper input neutralization during web page generation. This allows an attacker to execute malicious scripts in the victim's browser.
Risk Assessment
An attacker can hijack user sessions, steal data, or perform unauthorized actions in the victim's context, potentially leading to confidentiality and integrity breaches.
Recommendation
Update Fusion Builder to the latest version that includes a fix for this vulnerability. Additionally, consider implementing Content Security Policy (CSP) to mitigate XSS risks.
Other vulnerabilities in Fusion Builder
See all- CVE-2026-54193High
In Fusion Builder versions <= 3.15.4, there is a vulnerability that allows arbitrary file deletion by users with appropriate permissions.
- CVE-2026-54194Critical
Fusion Builder versions up to 3.15.4 are vulnerable to PHP Object Injection, which may lead to unauthorized access or data manipulation.
- CVE-2026-56008High
The Fusion Builder plugin for WordPress versions 3.15.4 and earlier contains a privilege escalation vulnerability exploitable by contributors. An attacker with contributor role can gain unauthorized access to administrative functions.
- CVE-2026-12256High
Deserialization of Untrusted Data vulnerability in ThemeFusion Fusion Builder fusion-builder allows Object Injection. This issue affects Fusion Builder from n/a through 3.15.3.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeFusion Fusion Builder fusion-builder allows DOM-Based XSS.This issue affects Fusion Builder: from n/a through <= 3.13.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS