The Avada (Fusion) Builder plugin for WordPress contains a stored cross‑site scripting flaw in the fusion_map shortcode. Insufficient input sanitization and output escaping allow an authenticated user with contributor or higher privileges to inject arbitrary JavaScript into a page. Once injected, the script runs in the context of any visitor to that page, enabling attackers to hijack sessions, deface content, or perform other malicious actions against site users. The weakness is classified as CWE‑79.

Vulnerable instances are any installation of the Avada (Fusion) Builder plugin up to and including version 3.12.1. Users running older versions should verify their install and consider upgrading.

The CVSS score of 6.4 indicates moderate severity. The EPSS score of less than 1% shows a very low likelihood of public exploitation at present, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires authenticated access with at least contributor permissions, making it a local rather than remote vector. However, once the script is stored, any site visitor becomes a target for client‑side attacks.