Is CVE-2026-104729 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-104729 being exploited in the wild.

How severe is CVE-2026-104729?

Medium severity, with a CVSS score of 6.4, published 28 October 2026.

Which products and versions are affected?

ThemeFusion Avada (Fusion) Builder up to and including 3.16.2.

Is there a fix for CVE-2026-104729?

Yes: fixed in Avada 7.16.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-104729 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-104729?

Check whether you run ThemeFusion Avada (Fusion) Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-104729: Avada Fusion Builder stored cross-site scripting in shortcode attributes

CVE-2026-104729 · Severity: medium · CVSS 6.4 · Published 2026-10-28

Avada Fusion Builder is a WordPress page builder plugin used to create website layouts and content. The plugin is vulnerable to stored XSS attacks that allow authenticated contributors to inject malicious scripts into pages, which execute when other users view those pages. An attacker with contributor or higher privileges can deface sites or steal user data without needing to use the admin interface.

Technologies: ThemeFusion Avada (Fusion) Builder. Vendors: ThemeFusion.

Quick answers

Is CVE-2026-104729 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-104729 being exploited in the wild.
How severe is CVE-2026-104729?: Medium severity, with a CVSS score of 6.4, published 28 October 2026.
Which products and versions are affected?: ThemeFusion Avada (Fusion) Builder up to and including 3.16.2.
Is there a fix for CVE-2026-104729?: Yes: fixed in Avada 7.16.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-104729 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-104729?: Check whether you run ThemeFusion Avada (Fusion) Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Avada 7.16.3

Technical details

Stored cross-site scripting in tab_index and empty_notice shortcode parameters due to insufficient input sanitization and output escaping. The WordPress kses sanitization function treats shortcode attribute content between square brackets as plain text rather than HTML, allowing dangerous payloads to persist. Affects authenticated attackers with contributor-level access and above on all versions up to and including 3.16.2.

Affected products

ThemeFusion Avada Fusion Builder up to and including 3.16.2

Timeline

2026-10-28: disclosed
2026-10-28: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.