CVE-2026-32454
DOM-Based XSS in ThemeFusion Avada Core Fusion-Core
Publication date: 2026-03-13
Last updated on: 2026-03-13
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| themefusion | avada_core | to 5.15.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-32454 is a Cross Site Scripting (XSS) vulnerability found in the WordPress Avada Core Plugin versions prior to 5.15.0.
This vulnerability allows a malicious actor to inject and execute malicious scripts—such as redirects, advertisements, or other HTML payloads—on websites using the affected plugin.
Exploitation requires user interaction by a privileged user with at least Contributor or Developer roles, who must perform an action like clicking a malicious link, visiting a crafted page, or submitting a form.
How can this vulnerability impact me? :
This vulnerability can allow attackers to execute malicious scripts on your website, potentially leading to unauthorized redirects, unwanted advertisements, or other harmful HTML payloads.
Because exploitation requires interaction by a privileged user, the risk is somewhat limited but still significant if such users are tricked.
The vulnerability has a CVSS severity score of 6.5, indicating a moderate impact with potential consequences including confidentiality, integrity, and availability losses.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate the CVE-2026-32454 vulnerability, you should update the Avada Core Plugin to version 5.15.0 or later, where the issue has been patched.
Since exploitation requires a privileged user to interact with malicious content, limiting user roles and educating users about suspicious links can also help reduce risk.