Is CVE-2026-84925 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-84925 being exploited in the wild.

How severe is CVE-2026-84925?

Medium severity, with a CVSS score of 6.1, published 2 October 2026.

Which products and versions are affected?

ThemeFusion Avada up to 7.16.1.

Is there a fix for CVE-2026-84925?

Yes: fixed in 7.16.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-84925 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-84925?

Check whether you run ThemeFusion Avada at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-84925: Avada theme reflected cross-site scripting in lang parameter

CVE-2026-84925 · Severity: medium · CVSS 6.1 · Published 2026-10-02

The Avada theme, a popular WordPress website builder, contains a reflected cross-site scripting vulnerability in the 'lang' parameter that could allow attackers to inject malicious scripts into pages. An attacker could trick users into clicking a malicious link that executes JavaScript code in their browsers, potentially leading to account hijacking, credential theft, or unauthorized actions on behalf of the victim.

Technologies: ThemeFusion Avada. Vendors: ThemeFusion.

Quick answers

Is CVE-2026-84925 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-84925 being exploited in the wild.
How severe is CVE-2026-84925?: Medium severity, with a CVSS score of 6.1, published 2 October 2026.
Which products and versions are affected?: ThemeFusion Avada up to 7.16.1.
Is there a fix for CVE-2026-84925?: Yes: fixed in 7.16.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-84925 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-84925?: Check whether you run ThemeFusion Avada at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 7.16.2

Technical details

A reflected XSS vulnerability exists in the 'lang' parameter due to insufficient input sanitization in the Fusion_Multilingual::set_active_language() function and missing output escaping when the value is concatenated into a URL by Fusion_Settings::get_setting_link(). The vulnerable value is echoed raw into a double-quoted href attribute in the post editor metabox without applying urlencode(), esc_url(), or esc_attr(). An unauthenticated attacker can inject arbitrary web scripts that execute when a victim clicks a crafted link.

Affected products

ThemeFusion Avada up to 7.16.1

Timeline

2026-10-02: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.