CVE-2026-16654 Overview
The Avada (Fusion) Builder plugin for WordPress contains a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in all versions up to and including 3.15.6. The flaw resides in the handling of the size shortcode attribute, where insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary JavaScript. Injected scripts execute in the browser of any user who accesses the affected page. WordPress's wp_kses_post filter fails to neutralize the payload because the malicious content sits entirely inside a shortcode attribute string with no HTML angle brackets, so kses passes it through unchanged at save time.
Critical Impact
Authenticated contributors can persist JavaScript that runs in the sessions of editors, administrators, and site visitors, enabling account takeover, content manipulation, and further privilege escalation.
Affected Products
- Avada (Fusion) Builder plugin for WordPress
- All versions up to and including 3.15.6
- WordPress sites permitting contributor-level or higher accounts
Discovery Timeline
- 2026-08-28 - CVE-2026-16654 published to NVD
- 2026-08-28 - Last updated in NVD database
Technical Details for CVE-2026-16654
Vulnerability Analysis
Avada (Fusion) Builder renders content through WordPress shortcodes that accept user-controlled attributes. The size attribute on affected shortcodes is stored and later reflected into rendered HTML without adequate escaping. Because the malicious payload is embedded as a shortcode attribute value rather than raw HTML markup, WordPress's wp_kses_post sanitization does not strip it during the save operation. When the shortcode is expanded at render time, the attribute value is emitted into the DOM in a context where it is interpreted as executable script.
This is a classic stored XSS pattern combined with a shortcode parser bypass. The attacker only needs contributor privileges, which many WordPress installations grant liberally for guest authors, freelancers, or community contributors.
Root Cause
The root cause is a two-part failure. First, input sanitization on the size shortcode attribute does not validate or restrict characters that permit script construction. Second, output escaping at shortcode render time does not context-encode the attribute value before inserting it into HTML. wp_kses_post is not a defense here because the payload contains no tags for kses to filter until the shortcode is expanded server-side.
Attack Vector
An authenticated user with contributor-level access or above crafts a post or page containing a Fusion Builder shortcode with a malicious size attribute. Once saved, the shortcode is stored in the WordPress database. When any user, including higher-privileged editors or administrators reviewing the submission, loads the page, the payload executes in their browser under the site's origin. This enables session theft, forced administrative actions via authenticated fetch requests, and injection of persistent backdoors through the admin UI.
No verified exploit code is publicly available. Refer to the Wordfence Vulnerability Report for advisory details.
Detection Methods for CVE-2026-16654
Indicators of Compromise
- Fusion Builder shortcodes stored in wp_posts.post_content containing size= attributes with quotes, event handlers such as onerror, onload, or javascript: URIs.
- Unexpected outbound requests from browsers rendering CMS pages to attacker-controlled domains.
- New administrator accounts, modified user roles, or altered plugin files created shortly after a contributor submitted content.
Detection Strategies
- Query the WordPress database for shortcodes containing suspicious size attribute values and review any content authored by contributor-role accounts.
- Inspect web server access logs for POST requests to /wp-admin/post.php or /wp-admin/admin-ajax.php from contributor accounts followed by administrator page views of the same post ID.
- Deploy Content Security Policy (CSP) reporting to surface inline script violations originating from CMS-rendered pages.
Monitoring Recommendations
- Alert on creation of WordPress administrator accounts or role elevations outside of change windows.
- Monitor for modifications to wp-config.php, plugin files, and theme files following contributor content submissions.
- Track browser telemetry for administrators accessing preview or draft URLs, which is the highest-value target for stored XSS payloads.
How to Mitigate CVE-2026-16654
Immediate Actions Required
- Update the Avada (Fusion) Builder plugin to a version later than 3.15.6 once the vendor publishes a fixed release. Review the Avada Changelog Documentation for the patched version.
- Audit all contributor-level and above accounts and remove or downgrade any that are inactive or unnecessary.
- Review recent posts and pages authored by contributor accounts for shortcodes containing script payloads.
Patch Information
Monitor the Avada Changelog Documentation and the Wordfence Vulnerability Report for the specific fixed version. Apply the patch across staging and production, then verify plugin version consistency across multisite installations.
Workarounds
- Restrict contributor-level accounts using a role management plugin to block use of Fusion Builder shortcodes until patched.
- Implement a strict Content Security Policy that disallows inline scripts and unsafe-eval on CMS-rendered pages.
- Require editorial review of all contributor submissions in a sandboxed browser session before publishing or previewing content as a privileged user.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
