CVE-2026-97340 Details
Description
The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Stored Cross-Site Scripting via the user profile 'Author Page' social link contact-method fields (author_facebook, author_twitter, author_linkedin, author_dribble, author_whatsapp, author_email) in versions up to, and including, 7.16.1. Avada registers these fields through the user_contactmethods filter and, on the author archive, emits them inside an anchor href using only esc_attr() in Fusion_Social_Icon::get_markup(), which escapes HTML metacharacters but does not reject dangerous URL schemes such as javascript:. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses their author page and clicks the injected social icon (a click is required, and the site must have 'Open Social Icons in a New Window' set to Off so the browser doesn't block the javascript: URL from opening in a new tab).
A stored cross-site scripting vulnerability has been identified in the Avada Website Builder for WordPress and WooCommerce, affecting versions through 7.16.1. The issue arises in the user profile 'Author Page' social link contact-method fields, including author_facebook, author_twitter, author_linkedin, author_dribble, author_whatsapp, and author_email. Avada registers these fields through the user_contactmethods filter and outputs them on the author archive page within an anchor tag. The theme only applies basic HTML character escaping, failing to sanitize harmful URL schemes like javascript:. This vulnerability allows authenticated attackers with Subscriber-level access and above to inject arbitrary scripts that execute when a user visits their author page and clicks on the modified social icon. The exploitation requires disabling the 'Open Social Icons in a New Window' option, so the browser does not block the javascript: link from opening in a new tab.
Users are advised to update to Avada version 7.16.2 or a newer patched version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 10, 2026CISA-ADP
Assessed Oct 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://avada.com/blog/version-7-16-2-security-update/ | [email protected] | AdvisoryRemedyVendor |
| https://www.wordfence.com/threat-intel/vulnerabilities/id/cbd47a59-5a9e-4eb2-9152-2cd47fc38ae2?source=cve | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Avada | <= 7.16.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 11, 2026 | CVE Modified | CISA-ADP |
| Oct 10, 2026 | New CVE Received | [email protected] |