The Avada (Fusion) Builder plugin for WordPress contains a stored cross‑site scripting flaw that allows an authenticated user with Contributor role or higher to inject malicious scripts that will run when any visitor loads the affected page. The issue arises from insufficient sanitization of the Module Title field, which is saved directly to the database and then rendered without escaping.

This vulnerability affects the Avada Builder plugin for WordPress, versions up to and including 3.15.5. Users running any of those versions should treat the installation as compromised for authenticated contributors and above.

The CVSS score of 6.4 indicates a medium‑severity flaw. EPSS <1% suggests a very low likelihood of exploitation. This vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that authenticated users with Contributor or higher access can inject arbitrary scripts via the Module Title field, which are stored and later rendered on pages. Once a malicious script is present, it executes in the browser context of any visitor to the affected page. Therefore, the attack vector is confined to authenticated contributors with module editing rights, but the impact extends to all site visitors who load the affected page.