# CVE-2026-1543: ThemeFusion Avada Builder Stored XSS in Shortcodes

Source: https://junglewise.ai/threats/cve-2026-1543-themefusion-avada-builder-stored-xss-in-shortcodes  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-21. Updated: 2026-05-21  
License: CC BY 4.0 with a link back

CVE-2026-1543 · Severity: medium · CVSS 6.4 · Published 2026-05-21

The Avada (Fusion) Builder plugin for WordPress, a popular tool for designing websites, is vulnerable to a security flaw that allows users with low-level accounts to inject malicious scripts into the site. These scripts are stored on the server and trigger automatically when an administrator views certain pages, such as those displaying user profiles. This could lead to unauthorized actions being performed on behalf of the administrator, potentially compromising the entire website.

Technologies: [ThemeFusion Avada Builder](https://junglewise.ai/threats/technologies/avada-builder). Vendors: [ThemeFusion](https://junglewise.ai/threats/vendors/themefusion).

## Quick answers

**Is CVE-2026-1543 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-1543 being exploited in the wild.

**How severe is CVE-2026-1543?** Medium severity, with a CVSS score of 6.4, published 21 May 2026.

**Which products and versions are affected?** ThemeFusion Avada (Fusion) Builder up to, and including, 3.15.2.

**Is there a fix for CVE-2026-1543?** A patch was published on 2026-05-12: Avada version 7.15.3 released (containing updated Fusion Builder) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-1543 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-1543?** Check whether you run ThemeFusion Avada Builder. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on multiple shortcodes. An authenticated attacker with Subscriber-level permissions or higher can exploit this by injecting arbitrary web scripts into pages. These scripts are executed in the context of a victim's browser (typically an administrator) when they access a page utilizing the 'Dynamic Data' feature to pull user-supplied information, such as biographical data. This vulnerability is classified under CWE-79 and was addressed in versions following 3.15.2.

## Affected products

- ThemeFusion Avada (Fusion) Builder up to, and including, 3.15.2

## Timeline

- 2026-05-12: patched: Avada version 7.15.3 released (containing updated Fusion Builder)
- 2026-05-21: disclosed: CVE-2026-1543 published by Wordfence/NVD

## References

- [https://avada.com/documentation/avada-changelog/](https://avada.com/documentation/avada-changelog/)
- [https://themeforest.net/item/avada-responsive-multipurpose-theme/2833226](https://themeforest.net/item/avada-responsive-multipurpose-theme/2833226)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/72a6b040-ed02-4561-82f2-4adb820bdf7d?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/72a6b040-ed02-4561-82f2-4adb820bdf7d?source=cve)

## Related threats

- [ThemeFusion Avada Builder stored XSS in Module Title parameter](https://junglewise.ai/threats/cve-2026-12536-themefusion-avada-builder-stored-xss-in-module-title-parameter)
- [ThemeFusion Avada Builder arbitrary file deletion via path traversal](https://junglewise.ai/threats/cve-2026-8713-themefusion-avada-builder-arbitrary-file-deletion-via-path)
- [ThemeFusion Avada Builder RCE via PHP Function Injection](https://junglewise.ai/threats/cve-2026-6279-themefusion-avada-builder-rce-via-php-function-injection)
- [ThemeFusion Avada Builder SQL injection in product_order parameter](https://junglewise.ai/threats/cve-2026-4798-themefusion-avada-builder-sql-injection-in-product-order-parameter)
- [Avada Builder arbitrary file read in fusion_get_svg_from_file](https://junglewise.ai/threats/cve-2026-4782-avada-builder-arbitrary-file-read-in-fusion-get-svg-from-file)