CVE-2025-31549
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Agency Dominion Inc. Fusion fusion allows DOM-Based XSS.This issue affects Fusion: from n/a through <= 1.6.4.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
DOM-based XSS vulnerability in WordPress Fusion plugin versions <= 1.6.4 allows attackers to inject malicious scripts.
Vulnerability
Overview
The Fusion plugin for WordPress versions <= 1.6.4 is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. The issue stems from improper neutralization of input during web page generation, allowing an attacker to inject arbitrary JavaScript code [1].
Exploitation
Details
Successful exploitation requires a privileged user to perform an action, such as clicking a malicious link or visiting a crafted page. The vulnerability can be initiated by a user with the required privilege level, but user interaction is needed for the attack to succeed [1].
Impact
An attacker can inject malicious scripts that execute when visitors access the website. This could lead to redirects, advertisements, or other HTML payloads being displayed, potentially compromising site integrity and user trust [1].
Mitigation
Users are strongly advised to update the Fusion plugin to a patched version immediately. If updating is not possible, contacting your hosting provider or web developer for assistance is recommended. This vulnerability is known to be used in mass-exploit campaigns [1].
AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1News mentions
0No linked articles in our index yet.