CVE-2026-84938

The Avada Fusion Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Form Notification Dynamic-Data actionhook → Media Upload Chain ID3 Metadata / htmlattributes in all versions up to, and including, 3.16.1 due to insufficient input sanitization and output escaping. This...