CVE-2026-97340 Overview
CVE-2026-97340 is a Stored Cross-Site Scripting (XSS) vulnerability in the Avada Website Builder theme for WordPress and WooCommerce. The flaw affects all versions up to and including 7.16.1. Authenticated users with Subscriber-level access or higher can inject arbitrary JavaScript through social link fields on their author profile. The payload executes when a visitor clicks the injected social icon on the author archive page. The weakness is classified under CWE-79.
Critical Impact
Low-privileged attackers can store javascript: URLs in author profile fields and hijack sessions, redirect users, or perform actions in the context of any visitor who clicks the icon.
Affected Products
- Avada Website Builder for WordPress & WooCommerce theme
- All versions up to and including 7.16.1
- WordPress sites with the Avada option 'Open Social Icons in a New Window' set to Off
Discovery Timeline
- 2026-10-10 - CVE-2026-97340 published to NVD
- 2026-10-13 - Last updated in NVD database
Technical Details for CVE-2026-97340
Vulnerability Analysis
Avada extends the WordPress user profile with additional social contact fields through the user_contactmethods filter. The registered fields include author_facebook, author_twitter, author_linkedin, author_dribble, author_whatsapp, and author_email. Any authenticated user can populate these fields from their own profile editor.
The stored values are later rendered on the author archive page inside an anchor href attribute by the Fusion_Social_Icon::get_markup() method. The theme sanitizes the output using esc_attr(), which escapes HTML metacharacters but does not validate the URL scheme. As a result, dangerous schemes such as javascript: pass through to the DOM.
Exploitation requires user interaction. A victim must click the injected social icon on the author's archive page, and the site must have the Avada option 'Open Social Icons in a New Window' set to Off. Modern browsers block javascript: URLs that open in a new tab, so this configuration gate is essential to execution.
Root Cause
The root cause is incomplete output sanitization. esc_attr() is designed to prevent attribute-breaking characters, not to validate URL protocols. Avada does not call esc_url() or apply a scheme allowlist before emitting the social link href. Any value a Subscriber can save, including javascript:alert(1), reaches the browser unchanged.
Attack Vector
An authenticated attacker with Subscriber privileges or higher edits their own profile and submits a payload such as javascript:fetch('/wp-admin/...') into one of the Avada social fields. The payload persists in the WordPress usermeta table. When any visitor opens the attacker's author page and clicks the corresponding icon, the browser executes the JavaScript in the origin of the vulnerable site. The attacker can steal session cookies, perform state-changing actions as the victim, or chain into privilege escalation if an administrator triggers the payload.
See the Wordfence Vulnerability Report for additional technical context.
Detection Methods for CVE-2026-97340
Indicators of Compromise
- Values in the WordPress usermeta table for author_facebook, author_twitter, author_linkedin, author_dribble, author_whatsapp, or author_email that begin with javascript:, data:, or vbscript: rather than http:// or https://.
- Author archive pages rendering anchor tags whose href attribute does not start with an allowed URL scheme.
- Recent profile edits from Subscriber or Contributor accounts that modified Avada social fields.
Detection Strategies
- Query wp_usermeta for the listed Avada social keys and flag any entries whose value does not match a strict URL scheme allowlist.
- Inspect server access logs for POST requests to /wp-admin/profile.php originating from low-privilege accounts, correlated with subsequent visits to /author/<username>/.
- Deploy web application firewall rules that reject profile submissions containing javascript: or encoded variants in Avada contact-method parameters.
Monitoring Recommendations
- Alert on new or modified user accounts at Subscriber level followed by profile edits touching Avada social metadata.
- Monitor outbound requests from browser sessions on author archive pages for anomalous destinations that indicate script execution.
- Track Avada theme version across the fleet and alert when sites remain on 7.16.1 or earlier.
How to Mitigate CVE-2026-97340
Immediate Actions Required
- Update the Avada theme to version 7.16.2 or later across all WordPress installations.
- Audit all user profiles for malicious values in the six affected social contact fields and sanitize or clear them.
- Set the Avada option 'Open Social Icons in a New Window' to On as a defense-in-depth measure until patching is complete.
Patch Information
ThemeFusion addressed the issue in Avada 7.16.2. The release notes are available in the Avada Security Update Post. Administrators should apply the update through the WordPress dashboard or by uploading the patched theme archive, then clear any caches and object caches that may serve rendered author pages.
Workarounds
- Restrict user registration to trusted accounts and disable open Subscriber signups if not required.
- Enable 'Open Social Icons in a New Window' in Avada options so browsers block javascript: URLs from executing.
- Apply a WAF rule that rejects profile updates containing non-HTTP(S) schemes in the affected author_* parameters.
# Example WP-CLI audit for malicious social link values
wp db query "SELECT user_id, meta_key, meta_value FROM wp_usermeta \
WHERE meta_key IN ('author_facebook','author_twitter','author_linkedin', \
'author_dribble','author_whatsapp','author_email') \
AND meta_value NOT REGEXP '^(https?://|mailto:|$)';"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
