CVE-2026-97340: Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'author_facebook' User Profile Field
The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Stored Cross-Site Scripting via the user profile 'Author Page' social link contact-method fields (authorfacebook, authortwitter, authorlinkedin, authordribble, authorwhatsapp, authoremail) in versions up to, and including, 7.16.1. Avada registers these fields through the usercontactmethods filter and, on the author archive, emits them inside an anchor href using only escattr() in FusionSocialIcon::getmarkup(), which escapes HTML metacharacters but does not reject dangerous URL schemes such as javascript:. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses their author page and clicks the injected social icon (a click is required, and the site must have 'Open Social Icons in a New Window' set to Off so the browser doesn't block the javascript: URL from opening in a new tab).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Set “Open Social Icons in a New Window” to On; the described exploit requires this setting to be Off.
Avada Open Social Icons in a New Window = On
Event History
Frequently Asked Questions
Which sites are exposed to exploitation?
Sites using Avada versions up to and including 7.16.1 are exposed if users can hold Subscriber-level or higher accounts, author archive pages are accessible, and the affected social icons open in the same window. Exploitation also depends on the site setting “Open Social Icons in a New Window” being set to Off.
What does an attacker need to exploit this issue?
An attacker needs an authenticated WordPress account with at least Subscriber privileges and must be able to set a malicious value in one of the affected Author Page social contact fields. A victim must then visit the attacker's author page and click the injected social icon.
Which profile fields should be reviewed for malicious values?
Review the Author Page social link fields author_facebook, author_twitter, author_linkedin, author_dribble, author_whatsapp, and author_email for dangerous URL schemes such as javascript:. These values are rendered as social-icon links on author archive pages.
What mitigation is available if updating is delayed?
Set “Open Social Icons in a New Window” to On, which prevents the described javascript: URL from executing in the same tab under the stated conditions. Also restrict untrusted users' ability to maintain accounts or alter profile fields, and review existing affected social-link values.