Description

The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'size' Shortcode Attribute in all versions up to, and including, 3.15.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. WordPress's wp_kses_post filter does not neutralize the payload because the injected content resides entirely within a shortcode attribute string containing no HTML angle brackets, causing kses to pass it through unchanged at save time.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-08-28T05:16:41.537Z",
  "pubdate": "2026-08-28T05:16:41.537Z",
  "executiveSummary": "The Avada (Fusion) Builder plugin for WordPress, a widely utilized page builder component, is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability. This security flaw affects all versions of the plugin up to, and including, version 3.15.6. The issue stems from insufficient input sanitization and output escaping of the 'size' shortcode attribute.\nThis vulnerability allows authenticated threat actors with contributor-level privileges or higher to inject malicious JavaScript payloads directly into WordPress pages or posts. When unsuspecting users, including administrative accounts, visit these compromised pages, the injected scripts execute seamlessly within the context of their active browser sessions.\nBecause the payload resides entirely within a shortcode attribute without utilizing traditional HTML angle brackets, standard WordPress sanitization filters like wp_kses_post fail to detect or neutralize the malicious content during the save process. The impact of this vulnerability is significant, potentially leading to unauthorized session hijacking, cookie theft, defacement of the affected website, or the execution of administrative tasks on behalf of the victim.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient input sanitization and output escaping mechanisms applied to the 'size' attribute within the shortcodes processed by the Avada (Fusion) Builder plugin. In a standard WordPress environment, the wp_kses_post function is heavily relied upon to sanitize content submitted by users, especially those with lower-level privileges such as contributors. This function is designed to strip out unauthorized HTML tags and attributes to prevent malicious injections.\nHowever, a crucial security bypass occurs when malicious input is placed entirely inside a shortcode attribute string. Because shortcode attributes typically do not contain HTML angle brackets (such as '<' and '>'), the wp_kses_post filter interprets the input as plain text or a benign string rather than HTML markup. Consequently, the sanitization filter passes the raw, unescaped payload through unchanged to the database at save time, leaving it completely intact. When the shortcode is subsequently rendered on the front end of the website, the Avada (Fusion) Builder fails to properly escape the 'size' attribute before outputting it into the HTML document object model (DOM), allowing the stored payload to execute within the victim's browser.\nTo exploit this vulnerability, an attacker must first obtain authenticated access to the target WordPress site with a minimum of contributor-level permissions. Contributors are permitted to create and edit posts but cannot publish them directly. Through the post editor, the attacker crafts a post containing an Avada (Fusion) Builder shortcode, embedding a malicious script or event handler (such as 'onload' or 'onerror' triggers) inside the 'size' attribute, breaking out of the attribute context.\nOnce the post is saved, the payload is permanently stored in the WordPress database. The attack flow is realized when any site visitor, administrator, or editor accesses the page containing the injected shortcode. Upon rendering, the web browser interprets the raw input from the 'size' attribute as executable code. If the payload executes under an administrator session, the attacker can leverage this execution to perform unauthorized administrative actions, such as creating rogue admin accounts, modifying sensitive settings, or exfiltrating session cookies. This vulnerability is present in all versions of the Avada (Fusion) Builder plugin up to, and including, version 3.15.6."
}