CVE-2026-1543

Name of the Vulnerable Software and Affected Versions Avada (Fusion) Builder plugin for WordPress versions prior to 3.15.3

Description The plugin is subject to Stored Cross-Site Scripting (XSS), a flaw where malicious scripts are permanently stored on the target server. This occurs due to insufficient input sanitization and output escaping within multiple shortcodes. Authenticated attackers with Subscriber-level access or higher can inject arbitrary web scripts into pages. These scripts execute when a user, typically an administrator, views a page that displays dynamic user data, such as biographical information retrieved via the Dynamic Data feature.

Recommendations Update the plugin to a version later than 3.15.2.