Avada Builder <= 3.11.14 - Authenticated (Contributor+) Stored Cross-Site Scripting

Vulnerability

The Avada (Fusion) Builder plugin for WordPress versions up to and including 3.11.14 is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on user-supplied attributes in several of the plugin's shortcodes. This allows authenticated attackers to inject arbitrary web scripts.

Exploitation

An attacker with contributor-level access or above can create or edit a page or post and insert a vulnerable shortcode with a malicious attribute containing JavaScript. When any user visits the page, the injected script executes.

Impact

Successful exploitation leads to stored XSS, enabling the attacker to execute arbitrary scripts in the context of the victim's browser. This can result in session hijacking, defacement, or redirection to malicious sites.

Mitigation

The vulnerability affects all versions up to 3.11.14. The vendor has not disclosed a fix in the provided references. Users should update to the latest version of the plugin if a patch is available, or apply input validation and output escaping as a workaround.