CVE-2026-97340
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The Avada theme for WordPress and WooCommerce is vulnerable to Stored Cross-Site Scripting via user profile 'Author Page' social link contact-method fields (author_facebook, author_twitter, author_linkedin, author_dribble, author_whatsapp, author_email) in versions up to and including 7.16.1. These fields are emitted in an anchor href without rejecting dangerous URL schemes such as javascript:.
Risk Assessment
An authenticated attacker with Subscriber-level access or above can inject malicious scripts that execute when a user clicks the injected social icon on the author page. This can lead to data theft or session hijacking.
Recommendation
Update the Avada theme to a version newer than 7.16.1 as soon as it is available, and consider disabling the 'Open Social Icons in a New Window' option or restricting subscriber privileges.
Other vulnerabilities in Avada
See all- CVE-2026-18431Critical
The Avada theme for WordPress up to version 7.16 is vulnerable to Arbitrary File Write when the Fusion Builder plugin is installed and active in versions up to 3.16. A chain of authorization and input validation weaknesses allows unauthenticated attackers to write attacker-controlled files to the server, leading to remote code execution and complete site compromise. Successful exploitation requires both Avada and Fusion Builder installed and active, as well as certain administrator-authored content.
- CVE-2026-84925Medium
The Avada theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'lang' parameter in all versions up to and including 7.16.1 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute if they can trick a user into clicking a link.
- CVE-2025-58922Medium
Cross-Site Request Forgery (CSRF) vulnerability in ThemeFusion Avada theme. Allows an attacker to perform unauthorized actions on behalf of a logged-in administrator. Affects versions before 7.13.2.
Original NVD description (English source)
The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Stored Cross-Site Scripting via the user profile 'Author Page' social link contact-method fields (author_facebook, author_twitter, author_linkedin, author_dribble, author_whatsapp, author_email) in versions up to, and including, 7.16.1. Avada registers these fields through the user_contactmethods filter and, on the author archive, emits them inside an anchor href using only esc_attr() in Fusion_Social_Icon::get_markup(), which escapes HTML metacharacters but does not reject dangerous URL schemes such as javascript:. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses their author page and clicks the injected social icon (a click is required, and the site must have 'Open Social Icons in a New Window' set to Off so the browser doesn't block the javascript: URL from opening in a new tab).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS