Threats tagged 'ghsa-7hr3-mm9w-ghgw'

CVE-2026-84925 is a reflected cross-site scripting (XSS) vulnerability in the Avada | Website Builder For WordPress & WooCommerce theme. It affects all versions up to and including 7.16.1. The vulnerability arises from improper input sanitization and output escaping of the 'lang' parameter, allowing unauthenticated attackers to inject arbitrary scripts. These scripts execute if a user is tricked into clicking a crafted link. The issue involves unsafe concatenation of the injected value into a URL within the post editor metabox without proper encoding.