CVE-2026-97340: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in ThemeFusion Avada | Website Builder For WordPress & WooCommerce

CVE-2026-97340 is a stored cross-site scripting vulnerability in the ThemeFusion Avada Website Builder for WordPress & WooCommerce theme. The issue exists in the user profile social link contact-method fields (author_facebook, author_twitter, author_linkedin, author_dribble, author_whatsapp, author_email) which are registered via the user_contactmethods filter. On the author archive page, these fields are output inside anchor href attributes using esc_attr() for escaping, which does not prevent dangerous URL schemes such as javascript:. This allows authenticated attackers with Subscriber-level access or above to inject arbitrary web scripts that execute when a user clicks the malicious social icon link, provided the site setting 'Open Social Icons in a New Window' is Off.

An attacker with at least Subscriber-level access can inject malicious JavaScript code into author profile social link fields. This code executes when other users visit the author page and click the crafted social icon link. The vulnerability allows limited cross-site scripting attacks that can lead to information disclosure or session hijacking. However, exploitation requires user interaction (clicking the link) and specific site configuration (social icons opening in the same window).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider restricting user permissions to prevent untrusted users from modifying social link fields or configure the site to open social icons in a new window, which blocks javascript: URLs from executing. Monitor vendor channels for an official patch or update.