Avada (Fusion) Builder vulnerabilities

The Avada (Fusion) Builder plugin for WordPress up to version 7.16.1 contains an authorization bypass vulnerability. An unauthenticated attacker can invoke arbitrary WordPress action hooks by sending a crafted request to the public form-submit endpoint, potentially leading to permanent deletion of content (posts, pages, comments) or other state changes.

The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'size' Shortcode Attribute in all versions up to, and including, 3.15.6 due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or above can inject arbitrary web scripts that execute whenever a user accesses an injected page.

The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Module Title' parameter in all versions up to and including 3.15.5 due to insufficient input sanitization and output escaping.

The Avada (Fusion) Builder plugin for WordPress up to version 3.15.2 is vulnerable to stored XSS via multiple shortcodes due to insufficient input sanitization and output escaping.