CVE-2026-84938

Name of the Vulnerable Software and Affected Versions Avada (Fusion) Builder versions prior to 3.16.2

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting. This occurs via the Form Notification Dynamic-Data action hook through a Media Upload Chain involving ID3 Metadata and html attributes. An attacker can inject arbitrary web scripts into pages that execute when accessed by a user. Successful exploitation requires a Fusion Form to be embedded on a page authored by an administrator and a Post Cards element configured to display attachment post types to be present on a publicly accessible page.

Recommendations Update Avada (Fusion) Builder to version 3.16.2 or later.