The Fusion Builder plugin for WordPress contains an improper neutralization of input during web page generation that allows reflected cross‑site scripting. This defect enables an attacker to inject malicious JavaScript which the browser will execute in the context of a vulnerable site, potentially leading to session hijacking, credential theft, or defacement. The weakness is classified as CWE‑79.

The vulnerability affects all installations of the ThemeFusion Fusion Builder plugin that are running any version earlier than 3.15.0; no higher‑version information is provided.

The CVSS score of 7.1 signals a moderate severity flaw. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is inferred to be public internet access, as an attacker can craft a malicious URL or input that reflects attacker-supplied content back to the browser; no special privileges or authentication are required for exploitation.