CVE-2026-16654

Name of the Vulnerable Software and Affected Versions Avada (Fusion) Builder versions prior to 3.15.7

Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. This is achieved by injecting arbitrary web scripts through the size shortcode attribute. The issue persists because the wp kses post filter, which is intended to sanitize content, does not neutralize the payload when it is contained within a shortcode attribute string without HTML angle brackets.

Recommendations Update Avada (Fusion) Builder to version 3.15.7 or later.