{"schema":"threatline.record/2","record":{"id":"CVE-2026-97340","aliases":[],"summary":"Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'author_facebook' User Profile Field","details":"The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Stored Cross-Site Scripting via the user profile 'Author Page' social link contact-method fields (author_facebook, author_twitter, author_linkedin, author_dribble, author_whatsapp, author_email) in versions up to, and including, 7.16.1. Avada registers these fields through the user_contactmethods filter and, on the author archive, emits them inside an anchor href using only esc_attr() in Fusion_Social_Icon::get_markup(), which escapes HTML metacharacters but does not reject dangerous URL schemes such as javascript:. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses their author page and clicks the injected social icon (a click is required, and the site must have 'Open Social Icons in a New Window' set to Off so the browser doesn't block the javascript: URL from opening in a new tab).","categories":["Applications & CMS"],"product":"Avada | Website Builder For WordPress & WooCommerce","vendor":"ThemeFusion","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97340","source_modified_at":"2026-10-11T12:13:43.659Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"Avada | Website Builder For WordPress & WooCommerce","vendor":"ThemeFusion","versions":[{"version":"0","status":"affected","lessThanOrEqual":"7.16.1","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":6.4,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00156,"percentile":0.04383,"score_date":"2026-10-23"},"published_at":"2026-10-10T07:41:48.155Z","modified_at":"2026-10-11T12:13:43.659Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-97340","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-11T12:13:43.659Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97340","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbd47a59-5a9e-4eb2-9152-2cd47fc38ae2?source=cve"},{"source":"CVE List","url":"https://avada.com/blog/version-7-16-2-security-update/"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-11T12:11:18.947998Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-11T12:13:43.659Z","content_hash":"c266f511b2d4112e0d07674283046b0c0045bc6df7c5e8e6046c00fbd0464949"}}