The Avada (Fusion) Builder plugin for WordPress contains a stored cross‑site scripting flaw. The tab_index and empty_notice shortcode attributes are not properly sanitized and do not escape dangerous characters before rendering. An attacker with contributor‑level or higher authentication can embed JavaScript in these attributes, persist the payload, and cause the script to execute whenever any user visits the page. This leakage can expose session data and enable further exploitation such as account takeover.

WordPress sites that have the Avada (Fusion) Builder plugin v3.16.2 or earlier installed are vulnerable. Any installation using these versions, regardless of other plugins or themes, is at risk.

The CVSS score of 6.4 indicates moderate to high severity. The EPSS score is unavailable, so the likelihood of active exploitation cannot be assessed. The vulnerability is not listed in the CISA KEV catalog. An attacker must first authenticate with contributor‑level or higher privileges to inject the payload, but once stored the script runs for all users viewing the short‑code‑enriched page, creating a persistent XSS threat within the site’s internal user base.