CVE-2026-84925

Name of the Vulnerable Software and Affected Versions Avada | Website Builder For WordPress & WooCommerce versions prior to 7.16.2

Description Reflected Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages by tricking a user into clicking a link. The issue exists because the lang parameter is processed through the set active language() function in Fusion Multilingual and concatenated into a URL by the get setting link() function in Fusion Settings without applying urlencode(), esc url(), or esc attr() before being echoed into a double-quoted href attribute in the post editor metabox.

Recommendations Update Avada | Website Builder For WordPress & WooCommerce to version 7.16.2 or later. As a temporary mitigation, restrict access to the post editor metabox to authorized users only.