The flaw permits authenticated users with Subscriber or higher privileges to inject executable JavaScript into the content of shortcodes that are stored by the Avada (Fusion) Builder plugin. When a page that renders that content is viewed, the malicious script runs in the context of the browser, allowing an attacker to steal session cookies, deface the site, or perform actions on behalf of the victim. The vulnerability represents a classic stored cross‑site scripting flaw (CWE‑79) that damages confidentiality, integrity, and potentially the availability of the web application by compromising the security of all viewers of affected pages.

All installations of the Avada (Fusion) Builder WordPress plugin with a version number of 3.15.2 or earlier are affected, regardless of the theme or WordPress core version. The problem originates from inadequate sanitization of shortcode parameters and lack of output escaping within the plugin’s handling of dynamic user data. Site administrators who run these vulnerable plugin versions must therefore consider themselves at risk.

The CVSS v3.1 score of 6.4 reflects a moderate severity level and indicates that the vulnerability is exploitable with authenticated access. No EPSS score is available, so the exact likelihood of exploitation cannot be quantified, but the absence of an EPSS value does not diminish the risk. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by modifying the content of pages that use a shortcode to display user biographical information; when those pages are subsequently viewed, the malicious code is executed. Because any administrator or user with editing rights can introduce the payload, the attack vector is primarily a trusted‑user code‑injection scenario.