CVE-2026-97340

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Stored Cross-Site Scripting via the user profile 'Author Page' social link contact-method fields (author_facebook, author_twitter, author_linkedin, author_dribble, author_whatsapp, author_email) in versions up to, and including, 7.16.1. Avada registers these fields through the user_contactmethods filter and, on the author archive, emits them inside an anchor href using only esc_attr() in Fusion_Social_Icon::get_markup(), which escapes HTML metacharacters but does not reject dangerous URL schemes such as javascript:. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses their author page and clicks the injected social icon (a click is required, and the site must have 'Open Social Icons in a New Window' set to Off so the browser doesn't block the javascript: URL from opening in a new tab).

• CWE-79

• https://avada.com/blog/version-7-16-2-security-update/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/cbd47a59-5a9e-4eb2-9152-2cd47fc38ae2?source=cve

Published

Oct 10, 2026

Last Modified

Oct 13, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-97335Incorrect authorization in the custom storage volume creatio…7.7
• CVE-2026-97336The CMB2 plugin for WordPress is vulnerable to Stored Cross-…7.2
• CVE-2026-97337The Simple Membership plugin for WordPress is vulnerable to …7.5
• CVE-2026-97338The Download Manager plugin for WordPress is vulnerable to S…6.4
• CVE-2026-97339The Complianz GDPR/CCPA Cookie Consent Banner plugin for Wor…7.2
• CVE-2026-9734The W3SC Elementor to Zoho CRM plugin for WordPress is vulne…4.3
• CVE-2026-97341The Visitor Traffic Real Time Statistics plugin for WordPres…7.2
• CVE-2026-97342The JetFormBuilder — Dynamic Blocks Form Builder plugin for …7.2
• CVE-2026-97343The Burst Statistics – Simple WordPress Analytics (Google An…4.3
• CVE-2026-97344The Wp Social Login and Register Social Counter plugin for W…6.4
• CVE-2026-97347The Post Views Stats Counter plugin for WordPress is vulnera…7.2
• CVE-2026-97348The SiteOrigin Widgets Bundle plugin for WordPress is vulner…6.5