CVE-2024-2311: 
WordPress vulnerability analysis and mitigation

The Avada theme for WordPress is vulnerable to Stored Cross-Site Scripting (CVE-2024-2311) via the plugin's shortcodes in versions up to and including 7.11.6. The vulnerability stems from insufficient input sanitization and output escaping on user-supplied attributes, allowing authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts that execute when users access affected pages (NVD).

The vulnerability exists in multiple components of the Avada theme, including fusion_form_submit, fusion_builder_column, and form submission URLs. Attackers can exploit the vulnerability by injecting malicious JavaScript code through various attributes and parameters such as link_attributes in shortcodes, form submission URLs, and redirect URLs. The vulnerability has been assigned a CVSS v3.1 base score of 5.4 (Medium) by NIST and 6.4 (Medium) by Wordfence (NVD, Wordfence).

When exploited, this vulnerability allows attackers to execute arbitrary web scripts in the context of other users' browsers, potentially leading to account takeover through creation of backdoor admin accounts, theft of sensitive information, or other malicious actions when privileged users like administrators view the compromised content (GitHub Exploit).

Multiple proof-of-concept exploits have been published demonstrating various attack vectors through the theme's shortcodes and form functionality. The vulnerability requires an authenticated user with at least contributor-level permissions, but can affect any user who views the compromised content, including administrators (GitHub Exploit, GitHub Exploit).

Users should upgrade to a version newer than 7.11.6 as soon as possible. For those unable to update immediately, it's recommended to carefully review and restrict contributor access to the site, and implement additional input validation and sanitization for user-supplied content (NVD).