CVE-2026-16654: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in themefusion Avada (Fusion) Builder

CVE-2026-16654 is a stored cross-site scripting vulnerability in the Avada (Fusion) Builder plugin for WordPress, affecting all versions up to and including 3.15.6. The issue stems from improper neutralization of input during web page generation (CWE-79), specifically via the 'size' shortcode attribute. Authenticated attackers with contributor-level permissions or higher can inject arbitrary web scripts that execute when users access the injected pages. The WordPress wp_kses_post filter fails to sanitize the payload because it resides entirely within a shortcode attribute string lacking HTML angle brackets, allowing the malicious content to pass through unchanged at save time.

Successful exploitation allows an authenticated user with contributor-level access or above to inject persistent malicious scripts into pages. These scripts execute in the context of users viewing the compromised pages, potentially leading to information disclosure or session hijacking. The vulnerability does not affect availability and requires authenticated access, limiting the attack surface.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory for updates. Until a fix is released, restrict contributor-level access to trusted users only and consider disabling or limiting use of the 'size' shortcode attribute in the Avada (Fusion) Builder plugin. Employing additional web application firewalls or content security policies may help mitigate impact but are not direct fixes.