TI-2026-70214 Aliases CVE-2026-97340 GHSA-w965-5f2v-mxvm

Stored cross-site scripting in Avada theme via author profile fields

LOW 27CWE-79Published 2026-10-10 · Updated 2026-10-11

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

ThemeFusion's Avada | Website Builder For WordPress & WooCommerce theme is affected through 7.16.1. The author page social link fields are output in links without rejecting javascript: URLs, which is a cross-site scripting flaw (CWE-79). An authenticated attacker with Subscriber access or higher can store a script that runs when a user opens the author page and clicks the injected social icon, provided Open Social Icons in a New Window is set to Off.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Stored Cross-Site Scripting via the user profile 'Author Page' social link contact-method fields (author_facebook, author_twitter, author_linkedin, author_dribble, author_whatsapp, author_email) in versions up to, and including, 7.16.1. Avada registers these fields through the user_contactmethods filter and, on the author archive, emits them inside an anchor href using only esc_attr() in Fusion_Social_Icon::get_markup(), which escapes HTML metacharacters but does not reject dangerous URL schemes such as javascript:. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses their author page and clicks the injected social icon (a click is required, and the site must have 'Open Social Icons in a New Window' set to Off so the browser doesn't block the javascript: URL from opening in a new tab).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00152 4th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
ThemeFusion	Avada \| Website Builder For WordPress & WooCommerce	up to 7.16.1	—	No fix listed	CNA

Avada | Website Builder For WordPress & WooCommerce VendorThemeFusion Affected up to 7.16.1 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:theme-fusion:avada::::::::	—	—	ThemeFusion

cpe:2.3:a:theme-fusion:avada:*:*:*:*:*:*:*:* Versions — — ·ThemeFusion

Remediation

The sources list no fixed version for Avada | Website Builder For WordPress & WooCommerce.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

2026-10-10 Threatist record created from CVE-2026-97340
2026-10-10 Alias added: GHSA-w965-5f2v-mxvm
2026-10-11 CISA SSVC decision points changed
2026-10-11 Priority changed: MEDIUM → LOW

References

Other 2

TI-2022-01267 Fusion Builder < 3.6.2 - Unauthenticated SSRF CVSS 3.1CRITICAL 9.8
TI-2026-05505 Injection in ThemeFusion Avada Builder CVSS 3.1CRITICAL 9.8
TI-2024-02175 Avada <= 7.11.6 - Unauthenticated Sensitive Information Exposure via Form Uploads Directory Listing CVSS 3.1MEDIUM 5.3
TI-2024-12389 Avada Theme <= 7.11.13 - Unauthenticated Arbitrary Shortcode Execution CVSS 3.1CRITICAL 9.8
TI-2026-15146 Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write CVSS 3.1CRITICAL 9.8
TI-2026-07656 Avada (Fusion) Builder <= 3.15.3 - Unauthenticated Arbitrary File Deletion via Form Entry Value CVSS 3.1CRITICAL 9.1

See all 57 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences