# CVE-2026-84925: Avada theme reflected cross-site scripting in lang parameter

Source: https://junglewise.ai/threats/cve-2026-84925-the-avada-website-builder-for-wordpress-woocommerce-theme-for  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-02. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-84925 · Severity: medium · CVSS 6.1 · Published 2026-10-02

The Avada theme, a popular WordPress website builder, contains a reflected cross-site scripting vulnerability in the 'lang' parameter that could allow attackers to inject malicious scripts into pages. An attacker could trick users into clicking a malicious link that executes JavaScript code in their browsers, potentially leading to account hijacking, credential theft, or unauthorized actions on behalf of the victim.

Technologies: [ThemeFusion Avada](https://junglewise.ai/threats/technologies/avada). Vendors: [ThemeFusion](https://junglewise.ai/threats/vendors/themefusion).

## Quick answers

**Is CVE-2026-84925 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-84925 being exploited in the wild.

**How severe is CVE-2026-84925?** Medium severity, with a CVSS score of 6.1, published 2 October 2026.

**Which products and versions are affected?** ThemeFusion Avada up to 7.16.1.

**Is there a fix for CVE-2026-84925?** Yes: fixed in 7.16.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-84925 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-84925?** Check whether you run ThemeFusion Avada at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 7.16.2

## Technical details

A reflected XSS vulnerability exists in the 'lang' parameter due to insufficient input sanitization in the Fusion_Multilingual::set_active_language() function and missing output escaping when the value is concatenated into a URL by Fusion_Settings::get_setting_link(). The vulnerable value is echoed raw into a double-quoted href attribute in the post editor metabox without applying urlencode(), esc_url(), or esc_attr(). An unauthenticated attacker can inject arbitrary web scripts that execute when a victim clicks a crafted link.

## Affected products

- ThemeFusion Avada up to 7.16.1

## Timeline

- 2026-10-02: disclosed

## References

- [https://classic.avada.com/documentation/avada-changelog/](https://classic.avada.com/documentation/avada-changelog/)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/4c3936aa-58d6-4ac0-a077-2faaed48828f?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/4c3936aa-58d6-4ac0-a077-2faaed48828f?source=cve)

## Related threats

- [Avada theme arbitrary file upload via Avada Forms](https://junglewise.ai/threats/cve-2026-115346-the-avada-website-builder-for-wordpress-woocommerce-theme-for)
- [Avada theme stored cross-site scripting in user profile](https://junglewise.ai/threats/cve-2026-97340-the-avada-website-builder-for-wordpress-woocommerce-theme-for)
- [ThemeFusion Avada PHP Object Injection](https://junglewise.ai/threats/cve-2026-12256-themefusion-avada-php-object-injection)