CVE-2026-97471
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
The Avada (Fusion) Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 3.16.1 via the 'args[link_target]' parameter. Unauthenticated attackers can extract arbitrary user meta values for any user ID, including administrator email addresses, login names, wp_user_level, and WooCommerce customer PII such as billing_email, billing_phone, and billing_address_1.
Risk Assessment
Exposure of personal data and login identifiers may lead to privacy breaches, phishing attacks, and further account takeover attempts.
Recommendation
Update the Avada (Fusion) Builder plugin to a version later than 3.16.1 and consider restricting access to the endpoint and rotating any exposed credentials.
Other vulnerabilities in Avada (Fusion) Builder
See all- CVE-2026-97670Critical
The Avada (Fusion) Builder plugin for WordPress up to version 7.16.1 contains an authorization bypass vulnerability. An unauthenticated attacker can invoke arbitrary WordPress action hooks by sending a crafted request to the public form-submit endpoint, potentially leading to permanent deletion of content (posts, pages, comments) or other state changes.
- CVE-2026-16654Medium
The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'size' Shortcode Attribute in all versions up to, and including, 3.15.6 due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or above can inject arbitrary web scripts that execute whenever a user accesses an injected page.
- CVE-2026-12536Medium
The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Module Title' parameter in all versions up to and including 3.15.5 due to insufficient input sanitization and output escaping.
- CVE-2026-1543Medium
The Avada (Fusion) Builder plugin for WordPress up to version 3.15.2 is vulnerable to stored XSS via multiple shortcodes due to insufficient input sanitization and output escaping.
Original NVD description (English source)
The Avada (Fusion) Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.16.1 via the 'args[link_target]' parameter. This makes it possible for unauthenticated attackers to extract arbitrary user meta values for any user ID, including administrator email addresses, login names, wp_user_level, and WooCommerce customer PII such as billing_email, billing_phone, and billing_address_1. The awb-instagram-nonce required to trigger this endpoint is printed in plaintext in fusionInstagramVars on any page rendering the [fusion_instagram] shortcode, making it harvestable by any anonymous visitor before the exploit request is sent.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS