CVE-2026-84938

The Avada Fusion Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Form Notification Dynamic-Data actionhook → Media Upload Chain ID3 Metadata / htmlattributes in all versions up to, and including, 3.16.1 due to insufficient input sanitization and output escaping. This...

CVE-2026-84938 Avada (Fusion) Builder <= 3.16.1 - Unauthenticated Stored Cross-Site Scripting via Form Notification Dynamic-Data action_hook

The Avada Fusion Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Form Notification Dynamic-Data actionhook → Media Upload Chain ID3 Metadata / htmlattributes in all versions up to, and including, 3.16.1 due to insufficient input sanitization and output escaping. This...

CVE-2026-84938

The Avada (Fusion) Builder plugin for WordPress (all versions up to and including 3.16.1 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw stems from insufficient input sanitization and output escaping within the Form Notification Dynamic-Data action_hook ↦ Media Upload Chain (ID3 M...

EUVD-2026-120827

The Avada Fusion Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Form Notification Dynamic-Data actionhook → Media Upload Chain ID3 Metadata / htmlattributes in all versions up to, and including, 3.16.1 due to insufficient input sanitization and output escaping. This...

WordPress Plugin: fusion-builder: CVE-2026-84938: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The Avada Fusion Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Form Notification Dynamic-Data actionhook → Media Upload Chain ID3 Metadata / htmlattributes in all versions up to, and including, 3.16.1 due to insufficient input sanitization and output escaping. This...

CVE-2026-84938: themefusion Avada (Fusion) Builder: The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Form Notification…

The Avada Fusion Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Form Notification Dynamic-Data actionhook → Media Upload Chain ID3 Metadata / htmlattributes in all versions up to, and including, 3.16.1 due to insufficient input sanitization and output escaping. This...

PT-2026-141547

The Avada Fusion Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Form Notification Dynamic-Data action hook → Media Upload Chain ID3 Metadata / html attributes in all versions up to, and including, 3.16.1 due to insufficient input sanitization and output escaping. Th...