# CVE-2026-104729: Avada Fusion Builder stored cross-site scripting in shortcode attributes

Source: https://junglewise.ai/threats/cve-2026-104729-the-avada-fusion-builder-plugin-for-wordpress-is-vulnerable-to  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-28. Updated: 2026-10-28  
License: CC BY 4.0 with a link back

CVE-2026-104729 · Severity: medium · CVSS 6.4 · Published 2026-10-28

Avada Fusion Builder is a WordPress page builder plugin used to create website layouts and content. The plugin is vulnerable to stored XSS attacks that allow authenticated contributors to inject malicious scripts into pages, which execute when other users view those pages. An attacker with contributor or higher privileges can deface sites or steal user data without needing to use the admin interface.

Technologies: [ThemeFusion Avada (Fusion) Builder](https://junglewise.ai/threats/technologies/avada-fusion-builder). Vendors: [ThemeFusion](https://junglewise.ai/threats/vendors/themefusion).

## Quick answers

**Is CVE-2026-104729 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-104729 being exploited in the wild.

**How severe is CVE-2026-104729?** Medium severity, with a CVSS score of 6.4, published 28 October 2026.

**Which products and versions are affected?** ThemeFusion Avada (Fusion) Builder up to and including 3.16.2.

**Is there a fix for CVE-2026-104729?** Yes: fixed in Avada 7.16.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-104729 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-104729?** Check whether you run ThemeFusion Avada (Fusion) Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Avada 7.16.3

## Technical details

Stored cross-site scripting in tab_index and empty_notice shortcode parameters due to insufficient input sanitization and output escaping. The WordPress kses sanitization function treats shortcode attribute content between square brackets as plain text rather than HTML, allowing dangerous payloads to persist. Affects authenticated attackers with contributor-level access and above on all versions up to and including 3.16.2.

## Affected products

- ThemeFusion Avada Fusion Builder up to and including 3.16.2

## Timeline

- 2026-10-28: disclosed
- 2026-10-28: advisory

## References

- [https://avada.com/blog/version-7-16-3-security-update/](https://avada.com/blog/version-7-16-3-security-update/)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/650d346d-c30a-4ee1-ac50-6a264e181174?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/650d346d-c30a-4ee1-ac50-6a264e181174?source=cve)

## Related threats

- [Avada Fusion Builder stored cross-site scripting in form notification](https://junglewise.ai/threats/cve-2026-84938-the-avada-fusion-builder-plugin-for-wordpress-is-vulnerable-to)
- [Avada Fusion Builder authorization bypass in form submission](https://junglewise.ai/threats/cve-2026-97670-the-avada-fusion-builder-plugin-for-wordpress-is-vulnerable-to)
- [Avada (Fusion) Builder stored cross-site scripting in shortcode attribute](https://junglewise.ai/threats/cve-2026-16654-avada-fusion-builder-stored-cross-site-scripting-in-shortcode)