CVE-2026-97340

Name of the Vulnerable Software and Affected Versions Avada | Website Builder For WordPress & WooCommerce versions prior to 7.16.2

Description Stored Cross-Site Scripting (XSS) occurs via the user profile Author Page social link contact-method fields. The issue exists because the Fusion Social Icon::get markup() function uses esc attr() to emit values inside an anchor href, which fails to reject dangerous URL schemes like javascript:. Authenticated attackers with Subscriber-level access or higher can inject arbitrary web scripts into the author facebook, author twitter, author linkedin, author dribble, author whatsapp, and author email variables. The script executes when a user visits the author page and clicks the injected social icon, provided the Open Social Icons in a New Window setting is disabled.

Recommendations Update to a version newer than 7.16.1. As a temporary mitigation, enable the Open Social Icons in a New Window setting to prevent the browser from executing javascript: URLs in the current tab.