MEDIUM
Avada <= 6.2.2 - Authenticated (Contributor+) Cross-Site Scripting
Published Jun 7, 2023
6.4
MEDIUMCVSS 3.1
EPSS 0.65%
Description
The Avada theme for WordPress is vulnerable to Stored Cross-Site Scripting via the update_layout function in versions up to, and including, 6.2.3 due to insufficient input sanitization and output escaping. This makes it possible for contributor-level attackers, and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected products
-
Affected
- ≥ 0, < 6.2.3
Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).
| Vendor | Product | Default status | Versions |
|---|---|---|---|
| ThemeFusion | Avada | Website Builder For WordPress & WooCommerce | unaffected | Affected
|
- ≤ 6.2.3
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (4)
- https://blog.nintechnet.com/avada-wordpress-theme-fixed-multiple-vulnerabilities/ Exploit
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-24153 Advisory
- https://theme-fusion.com/security-fix-added-in-6-2-3/ Release Notes
- https://www.wordfence.com/threat-intel/vulnerabilities/id/684a1e8e-30f2-47dd-9df6-145198030c52?source=cve Third Party Advisory
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner Wordfence
Published Jun 7, 2023
Updated Apr 8, 2026
Reserved Jun 6, 2023
Link CVE-2020-36711
CISA Vulnrichment
Updated Dec 20, 2024
Red Hat
No data
GitHub
No data