CVE-2026-97340

Executive Summary

The Avada | Website Builder For WordPress & WooCommerce theme (versions up to and including 7.16.1) is vulnerable to stored cross-site scripting via user profile "Author Page" social link contact-method fields. Authenticated attackers with Subscriber-level access or above can inject arbitrary web scripts that execute when a victim user accesses the attacker's author page and clicks an injected social icon. Exploitation requires a click and the site setting "Open Social Icons in a New Window" to be Off.

Technical Analysis

This vulnerability is a stored cross-site scripting (XSS) flaw (CWE-79) in the Avada theme for WordPress. Avada registers six custom user profile contact-method fields — author_facebook, author_twitter, author_linkedin, author_dribble, author_whatsapp, and author_email — through the WordPress user_contactmethods filter. These fields are intended to hold social media links that are rendered on the author archive page.

The flaw lies in how the theme emits these values. In the Fusion_Social_Icon::get_markup() method, the stored contact-method values are placed inside an anchor href attribute using only esc_attr(). The esc_attr() function escapes HTML metacharacters (such as ", <, >, &) but does not validate or restrict the URL scheme. As a result, a value such as javascript: followed by script code is accepted and written into the href attribute of the rendered anchor. When a user clicks the social icon, the browser executes the javascript: payload in the context of the vulnerable site.

Two conditions constrain exploitation: (1) a click on the injected social icon is required, and (2) the site must have the "Open Social Icons in a New Window" setting set to Off — if that option is On, the link opens in a new tab and modern browsers block javascript: execution in the new context, neutralizing the attack. The attacker needs only Subscriber-level authentication, which is a low privilege bar in typical WordPress deployments.

Because the payload is stored in user profile data and rendered on the author archive, the malicious script persists and executes for any visitor who clicks the affected icon on the attacker's author page. The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N (score 6.4) reflects network attackability, low attack complexity, low privileges required, no privileges required beyond the initial foothold per the vector's UI:N entry (note: the described click requirement is a mitigating nuance), a scope change (S:C), and low confidentiality and integrity impact.

Exploitation Scenarios

1. Reconnaissance / target identification: The attacker identifies a WordPress site running the Avada theme at version 7.16.1 or earlier. This can be done by fingerprinting theme assets, style.css version strings, or known Avada-specific markup. The attacker also checks whether the site's social icon configuration opens links in the same window ("Open Social Icons in a New Window" = Off), which is the prerequisite for execution.

2. Triggering the flaw class: The attacker registers or obtains an account with at least Subscriber-level privileges. Using the standard WordPress user profile editor (or any mechanism that writes to user_contactmethods fields), the attacker sets one or more of the social link fields — for example author_facebook — to a javascript: URI containing malicious script code. Because the theme applies only esc_attr() at render time, the scheme is not rejected and the payload is stored.

3. Payload / execution method: When a victim user visits the attacker's author archive page, the stored value is emitted into the href attribute of the rendered social icon anchor by Fusion_Social_Icon::get_markup(). The victim must click the icon. On click, the browser executes the javascript: payload in the site's origin, as long as the link is not forced to open in a new window. No public PoC is available; the attack chain is inferred from the vulnerability class and the NVD description.

4. Post-exploitation impact: Successful execution yields script execution in the victim's authenticated session context. An attacker could use this to perform actions as the victim (e.g., session hijacking via cookie/token theft, CSRF-token exfiltration, or driving the victim's browser to perform privileged actions within the site), depending on the victim's role. Severity is bounded by the required click and by the browser's javascript: link handling.

Impact Assessment

The vulnerability affects any WordPress site running the Avada theme up to and including version 7.16.1 where the relevant social icon fields are rendered on author archives and the "Open Social Icons in a New Window" option is Off. Because the stored payload executes in the origin of the vulnerable site, the blast radius includes any authenticated victim who clicks the icon — potentially administrators or editors viewing an author page. The scope change (S:C) in the CVSS vector indicates the impact can cross a security boundary, e.g., affecting components beyond the vulnerable author-page context. Confidentiality and integrity impacts are rated Low (C:L/I:L), and availability is None (A:N). The overall base score is 6.4 (Medium). No public exploit or Nuclei template is known at this time, and the CVE is not in CISA KEV.

Detection Guidance

Sigma Rule

title: Avada Theme Stored XSS via Author Social Link Fields
id: 8f2c1a44-7b9e-4c3d-9a1f-5e6b2d0c9f31
status: experimental
description: Detects updates to Avada author social contact-method fields containing javascript or other dangerous URI schemes.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-97340
author: valtersit.com
date: 2026-01-01
logsource:
  product: wordpress
  service: user_profile
detection:
  selection_fields:
    field_name:
      - author_facebook
      - author_twitter
      - author_linkedin
      - author_dribble
      - author_whatsapp
      - author_email
  selection_payload:
    field_value|contains:
      - 'javascript:'
      - 'data:'
      - 'vbscript:'
  condition: selection_fields and selection_payload
falsepositives:
  - Legitimate links that accidentally include the literal string "javascript:"
level: high

YARA Rule

rule CVE_2026_97340_Avada_Stored_XSS
{
    meta:
        description = "Detects javascript: scheme payloads stored in Avada author social contact-method fields"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-97340"
        date = "2026-01-01"
    strings:
        $field1 = "author_facebook"
        $field2 = "author_twitter"
        $field3 = "author_linkedin"
        $field4 = "author_dribble"
        $field5 = "author_whatsapp"
        $field6 = "author_email"
        $js = "javascript:"
    condition:
        any of ($field*) and $js
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-97340 Avada Theme Stored XSS author social link javascript scheme"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"profile.php" or content:"user-edit.php" or content:"admin-ajax.php"; http.request_body; content:"author_facebook" or content:"author_twitter" or content:"author_linkedin" or content:"author_dribble" or content:"author_whatsapp" or content:"author_email"; http.request_body; content:"javascript:"; nocase; classtype:web-application-attack; sid:2026973401; rev:1;)

Elastic Detection

sequence by user.name with maxspan=5m
  [ any where event.category == "authentication" and event.action == "user_profile_update" and user.name != null ]
  [ any where event.category == "web" and process.name : ("php", "php-fpm", "nginx", "apache") and
      url.path : ("/wp-admin/profile.php", "/wp-admin/user-edit.php", "/wp-admin/admin-ajax.php") and
      http.request.method == "POST" and
      (http.request.body : ("author_facebook=*javascript:*", "author_twitter=*javascript:*",
                            "author_linkedin=*javascript:*", "author_dribble=*javascript:*",
                            "author_whatsapp=*javascript:*", "author_email=*javascript:*")) ]

Splunk SPL Query

index=webproxy OR index=apache OR index=nginx
(http.request.method=POST)
(url_path IN ("/wp-admin/profile.php","/wp-admin/user-edit.php","/wp-admin/admin-ajax.php"))
(http.request.body="*author_facebook*" OR http.request.body="*author_twitter*" OR http.request.body="*author_linkedin*" OR http.request.body="*author_dribble*" OR http.request.body="*author_whatsapp*" OR http.request.body="*author_email*")
(http.request.body="*javascript:*" OR http.request.body="*vbscript:*")
| stats count min(_time) as first_seen max(_time) as last_seen values(url_path) as paths by src_ip, user
| where count > 0
| sort - first_seen

Wazuh OSSEC Rule

<group name="web,appsec,avada_xss,">
  <rule id="100973" level="12">
    <if_sid>31100,31103,31108,31151</if_sid>
    <field name="url">profile\.php|user-edit\.php|admin-ajax\.php</field>
    <field name="request_body">author_(facebook|twitter|linkedin|dribble|whatsapp|email)</field>
    <field name="request_body">javascript:|vbscript:</field>
    <description>CVE-2026-97340 - Possible Avada theme stored XSS via author social link field injection</description>
    <mitre>
      <id>T1059.007</id>
    </mitre>
    <group>web_attack,xss,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version metadata is available from tracked sources; the version ceiling (<= 7.16.1) is taken from the NVD description.

1. Immediate mitigations:

   • Set the Avada option "Open Social Icons in a New Window" to On to prevent javascript: URIs from executing in the same window; this neutralizes the described attack path while a fix is pending.
   • Restrict or audit Subscriber-level accounts, and avoid granting contributor or higher roles unnecessarily; the flaw only requires Subscriber access.
   • Sanitize/validate the author_facebook, author_twitter, author_linkedin, author_dribble, author_whatsapp, and author_email user meta values, allowing only http/https schemes.
   • Deploy a Web Application Firewall (WAF) or virtual patch that inspects writes to these profile fields for javascript:/data:/vbscript: schemes.
   • Consider temporarily disabling the author archive social icon rendering until the theme is fixed.

2. Patch / upgrade steps:

   • No patched version is currently identified. Monitor the Avada vendor channels for a security release addressing Fusion_Social_Icon::get_markup() scheme validation, and apply it as soon as available.
   • Until then, treat any Avada version <= 7.16.1 as vulnerable.

3. Long-term hardening:

   • Require output-encoding helpers that enforce URL scheme allow-listing (not just HTML metacharacter escaping) for all user-controlled link attributes.
   • Enforce Content Security Policy (CSP) that blocks javascript: and data: inline script execution, as a defense-in-depth control against XSS.
   • Apply least-privilege role management and regularly review user accounts with author-archive exposure.
   • Maintain a WordPress theme/plugin patch cadence and enable integrity monitoring for theme files.

References

• NVD — CVE-2026-97340: https://nvd.nist.gov/vuln/detail/CVE-2026-97340
• CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
• MITRE ATT&CK T1059.007 — Command and Scripting Interpreter: JavaScript: https://attack.mitre.org/techniques/T1059/007/
• CVSS v3.1 Specification: https://www.first.org/cvss/v3.1/specification-document
• Vendor: Avada (Themeforest / Theme-Fusion) — monitor for security advisories (no advisory published at time of writing)

No public PoC, exploit code, Nuclei template, or known threat actor campaign exploitation evidence was identified for CVE-2026-97340. The CVE is not listed in CISA KEV. EPSS has not yet been scored by FIRST.org.