CVE-2024-2311: theme-fusion avada Cross-site Scripting
Vulnerability summary
CVE-2024-2311 is a medium (CVSS 6.4) Cross-site Scripting vulnerability in theme-fusion avada. EPSS estimates a 0.69% chance of exploitation in the next 30 days, higher than 52.1% of scored vulnerabilities. 4 public exploits are recorded. Fixed in 7.11.7.
Timeline
- 09-04-2024PublishedVulnerability first disclosed.
- 08-04-2026Last modifiedVulnerability information updated.
Description
The Avada theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 7.11.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS metrics
3 scores · 3 sources · 1 version- NVDNIST5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NDiffers
- wordfenceSource6.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
EPSS trend
Probability
0.69%
Chance of exploitation in the next 30 days
Percentile
52%
Versus all other CVEs
30-day change
0.00 pp
From 0.69% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
4 found8B0F2Bf40092E00851Fe2F57F15E947E
Maturity: poc
D3C36F7Befe7D380Ed240D3Cb141D64C
Maturity: poc
Ebb7E1Dee2B073B8A478C2F663521B30
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Theme-fusion1 product
- avada< 7.11.7
Themefusion1 product
Wordpress1 product
- avada≤ 7.11.6 (fixed in 7.11.7)
3 vendors · 3 products