CVE-2026-97340 ThemeFusion CVE debrief

Who should care

Defenders responsible for WordPress installations using the Avada theme should assess exposure and apply the security update. Site administrators and security teams should verify the version of the Avada theme and restrict access to the user profile 'Author Page' social link contact-method fields to prevent exploitation.

Why it matters

The Avada theme for WordPress is vulnerable to Stored Cross-Site Scripting, allowing authenticated attackers to inject arbitrary web scripts. Defenders should prioritize verifying exposure and applying the security update to prevent exploitation.

• Defenders must verify exposure and apply the vendor's security update to prevent exploitation
• Site administrators must restrict access to the user profile 'Author Page' social link contact-method fields to limit the attack surface
• Security teams should monitor for suspicious activity on author pages to detect potential exploitation attempts

Technical summary

The Avada theme for WordPress is vulnerable to Stored Cross-Site Scripting via the user profile 'Author Page' social link contact-method fields in versions up to, and including, 7.16.1. Authenticated attackers with Subscriber-level access can inject arbitrary web scripts, which will execute when a user accesses their author page and clicks the injected social icon. The vulnerability exists due to the theme's handling of social link fields, which allows attackers to inject web scripts that will execute on the author's page.

Defensive priority

Defenders should prioritize verifying exposure and applying the vendor's security update.

Recommended defensive actions

• Verify the Avada theme version and apply the security update if necessary
• Restrict access to the user profile 'Author Page' social link contact-method fields
• Monitor for suspicious activity on author pages
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability exists in the Avada theme's handling of social link fields, which allows authenticated attackers with Subscriber-level access to inject arbitrary web scripts. The Avada theme registers these fields through the user_contactmethods filter and, on the author archive, emits them inside an anchor href using only esc_attr() in Fusion_Social_Icon::get_markup(), which escapes HTML metacharacters but does not reject dangerous URL schemes such as javascript:. This makes it possible for attackers to inject web scripts that will

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.