CVE Database /
CVE-2026-32454
CVE · Medium
CVE-2026-32454 — Fusion Core [fusion-core] < 5.15.0
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2026-32454
|
Fusion Core [fusion-core] < 5.15.0 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium
6.5
|
< 5.15.0
|
5.15.0 |
2026-03-10 |
—
|
CVE-2026-32454
The Avada Core plugin for WordPress contains a security flaw affecting versions prior to 5.15.0, allowing malicious users with at least contributor permissions to embed unauthorized code snippets into certain website pages, which can then be executed by visitors upon accessing those pages. This vulnerability stems from inadequate measures being taken to cleanse and sanitize user input before it's displayed on the site.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings