CVE-2026-84938

The Avada Fusion Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Form Notification Dynamic-Data actionhook → Media Upload Chain ID3 Metadata / htmlattributes in all versions up to, and including, 3.16.1 due to insufficient input sanitization and output escaping. This...

CVE-2026-84938

The Avada (Fusion) Builder plugin for WordPress (all versions up to and including 3.16.1 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw stems from insufficient input sanitization and output escaping within the Form Notification Dynamic-Data action_hook ↦ Media Upload Chain (ID3 M...

EUVD-2026-120827

The Avada Fusion Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Form Notification Dynamic-Data actionhook → Media Upload Chain ID3 Metadata / htmlattributes in all versions up to, and including, 3.16.1 due to insufficient input sanitization and output escaping. This...