Threats tagged 'ghsa-f43f-8f8g-rmhr'

The Avada (Fusion) Builder plugin for WordPress up to version 3.16.1 is vulnerable to stored cross-site scripting (XSS) via the Form Notification Dynamic-Data action_hook. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute when users access affected pages. Exploitation requires specific conditions involving Fusion Forms and Post Cards elements on admin-authored and publicly accessible pages.