CVE-2026-84938: 
WordPress 취약점 분석 및 완화

CVE-2026-84938 is a Stored Cross-Site Scripting (Stored XSS) vulnerability in the Avada (Fusion) Builder plugin for WordPress, affecting all versions up to and including 3.16.1. The flaw exists in the Form Notification Dynamic-Data action_hook → Media Upload Chain (ID3 Metadata / html_attributes) due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts into pages. It was published on November 10, 2026, with a patch made available the same day. The vulnerability carries a CVSS v3.1 base score of 7.2 (High) (GitHub Advisory, Feedly).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The attack chain involves two components: first, a Fusion Form embedded on an admin-authored page that grants manage_options context to the Dynamic Data action hook callback; second, a Post Cards element configured to display attachment post types on a publicly accessible page, which renders the planted shortcode payload. An unauthenticated attacker can embed malicious scripts via ID3 metadata in uploaded media files or through html_attributes, which are then stored and later executed in victims' browsers when they visit the affected page (GitHub Advisory, Feedly).

Successful exploitation allows unauthenticated attackers to inject persistent malicious scripts that execute in the browsers of all users — including administrators — who visit the affected pages. This can result in session token theft, unauthorized actions performed on behalf of logged-in users (including privilege escalation via admin session hijacking), content defacement, and redirection of users to malicious sites. The changed scope (S:C) in the CVSS vector reflects that the impact extends beyond the vulnerable component to the browsers of site visitors (GitHub Advisory, Feedly).

As of the disclosure date (November 10, 2026), there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation. The CVE status is listed as "Deferred" and no threat actor attribution has been reported. The attack requires no authentication and low complexity, but does depend on specific site configuration preconditions (Fusion Form on an admin-authored page and a Post Cards element displaying attachment post types). No EPSS score or CISA KEV catalog entry has been identified for this CVE (GitHub Advisory, Feedly).

1. Reconnaissance: Identify WordPress sites using the Avada (Fusion) Builder plugin version ≤ 3.16.1 with a Fusion Form embedded on an admin-authored page and a Post Cards element configured to display attachment post types on a publicly accessible page.
2. Craft malicious media file: Prepare a media file (e.g., an MP3) with a malicious JavaScript payload embedded in its ID3 metadata tags (e.g., title, artist, or comment fields), or craft a payload targeting html_attributes in the form notification dynamic data chain.
3. Upload the file: Submit the crafted media file through the Fusion Form's media upload functionality on the target site — no authentication is required.
4. Trigger payload storage: The Dynamic Data action hook callback processes the uploaded file's metadata without adequate sanitization, storing the malicious shortcode payload in the WordPress database.
5. Payload execution: When any user (including administrators) visits the publicly accessible page containing the Post Cards element configured to display attachment post types, the stored shortcode is rendered and the injected JavaScript executes in their browser, enabling session hijacking, credential theft, or further malicious actions (GitHub Advisory, Feedly).

• File System: Media files (e.g., MP3s) uploaded via Fusion Forms containing unexpected or obfuscated content in ID3 metadata fields (title, artist, comment, album tags).
• Database: WordPress wp_posts or wp_postmeta entries associated with attachment post types containing <script> tags, encoded JavaScript, or suspicious shortcode syntax injected into metadata fields.
• Logs: WordPress access logs showing unauthenticated POST requests to Fusion Form media upload endpoints, particularly with unusual file payloads or repeated submissions from the same IP.
• Network: Outbound requests from victim browsers to unknown external domains (e.g., for cookie exfiltration or payload delivery) originating from pages hosting Post Cards elements.
• Browser/Application: Unexpected JavaScript execution or redirects observed by users visiting pages with Post Cards elements displaying attachment post types (GitHub Advisory).

Update the Avada (Fusion) Builder plugin to a version newer than 3.16.1, which contains the fix for this vulnerability. As an interim workaround, remove or disable Fusion Forms from admin-authored pages and ensure that Post Cards elements are not configured to display attachment post types on publicly accessible pages until patching is completed. Site administrators should also audit existing media uploads for suspicious ID3 metadata content (GitHub Advisory, Feedly).

The vulnerability was reported to the GitHub Advisory Database and NVD on November 10, 2026, with Wordfence credited as the reporting source. No notable public researcher commentary, vendor statements beyond the advisory, or significant social media discussion has been identified at this time (GitHub Advisory).