The vulnerability is an Improper Neutralization of Input During Web Page Generation (Cross-site Scripting). It allows DOM‑Based XSS in the ThemeFusion Avada Core "fusion‑core" plugin. When an attacker supplies crafted input that is reflected into the page, malicious client‑side script can be executed in the victim’s browser, enabling actions such as cookie theft, defacement, or phishing. The weakness is identified as CWE‑79.

The affected product is the WordPress Avada Core plugin developed by ThemeFusion. Versions from the earliest released build through any release older than 5.15.0 are vulnerable. Any WordPress site that has Avada Core installed with a version number less than 5.15.0 is at risk.

The CVSS score is 6.5, which denotes medium severity. The EPSS score is reported as less than 1 %, indicating a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The exploit requires that the attacker supply input that is rendered in the DOM; while the exact attack vector is not formally documented, it is inferred that user‑controllable fields or URL parameters in the WordPress admin or front‑end interface could be used to inject the malicious payload.