CVE-2024-5628: Avada WordPress Plugin Contributor Stored XSS via fusion_button Shortcode

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Name: Avada 2. Vulnerability Description: - Describes a stored cross-site scripting (XSS) vulnerability in the Avada plugin's shortcode. - The vulnerability allows users with Contributor or higher privileges to inject arbitrary scripts into pages, which will execute when users visit the compromised page. - The vulnerability was partially fixed in version 3.11.9, with additional hardening implemented in version 3.11.10. 3. Vulnerability Rating: - CVSS Score: 3.1 - CVSS Score: 6.4 (Medium) 4. Public Release Date: September 12, 2024 5. Last Updated Date: September 13, 2024 6. Researcher: wesley (wcraft) 7. Affected Versions: <= 3.11.9 8. Fixed Version: 3.11.10 9. Remediation Recommendation: Upgrade to version 3.11.10 or higher. 10. Vulnerability Type: Web page generation with input not properly neutralized (Cross-Site Scripting) 11. Vulnerability ID: CVE-2024-5628 12. Disclosure Status: Public 13. Disclosure Date: September 12, 2024 14. Disclosure Date: September 13, 2024 15. Disclosure Date: September 13, 2024 16. Disclosure Date: September 13, 2024 17. Disclosure Date: September 13, 2024 18. Disclosure Date: September 13, 2024 19. Disclosure Date: September 13, 2024 20. Disclosure Date: September 13, 2024 21. Disclosure Date: September 13, 2024 22. Disclosure Date: September 13, 2024 23. Disclosure Date: September 13, 2024 24. Disclosure Date: September 13, 2024 25. Disclosure Date: September 13, 2024 26. Disclosure Date: September 13, 2024 27. Disclosure Date: September 13, 2024 28. Disclosure Date: September 13, 2024 29. Disclosure Date: September 13, 2024 30. Disclosure Date: September 13, 2024 31. Disclosure Date: September 13, 2024 32. Disclosure Date: September 13, 2024 33. Disclosure Date: September 13, 2024 34. Disclosure Date: September 13, 2024 35. Disclosure Date: September 13, 2024 36. Disclosure Date: September 13, 2024 37. Disclosure Date: September 13, 2024 38. Disclosure Date: September 13, 2024 39. Disclosure Date: September 13, 2024 40. Disclosure Date: September 13, 2024 41. Disclosure Date: September 13, 2024 42. Disclosure Date: September 13, 2024 43. Disclosure Date: September 13, 2024 44. Disclosure Date: September 13, 2024 45. Disclosure Date: September 13, 2024 46. Disclosure Date: September 13, 2024 47. Disclosure Date: September 13, 2024 48. Disclosure Date: September 13, 2024 49. Disclosure Date: September 13, 2024 50. Disclosure Date: September 13, 2024 51. Disclosure Date: September 13, 2024 52. Disclosure Date: September 13, 2024 53. Disclosure Date: September 13, 2024 54. Disclosure Date: September 13, 2024 55. Disclosure Date: September 13, 2024 56. Disclosure Date: September 13, 2024 57. Disclosure Date: September 13, 2024 58. Disclosure Date: September 13, 2024 59. Disclosure Date: September 13, 2024 60. Disclosure Date: September 13, 2024 61. Disclosure Date: September 13, 2024 62. Disclosure Date: September 13, 2024 63. Disclosure Date: September 13, 2024 64. Disclosure Date: September 13, 2024 65. Disclosure Date: September 13, 2024 66. Disclosure Date: September 13, 2024 67. Disclosure Date: September 13, 2024 68. Disclosure Date: September 13, 2024 69. Disclosure Date: September 13, 2024 70. Disclosure Date: September 13, 2024 71. Disclosure Date: September 13, 2024 72. Disclosure Date: September 13, 2024 73. Disclosure Date: September 13, 2024 74. Disclosure Date: September 13, 2024 75. Disclosure Date: September 13, 2024 76. Disclosure Date: September 13, 2024 77. Disclosure Date: September 13, 2024 78. Disclosure Date: September 13, 2024 79. Disclosure Date: September 13, 2024 80. Disclosure Date: September 13, 2024 81. Disclosure Date: September 13, 2024 82. Disclosure Date: September 13, 2024 83. Disclosure Date: September 13, 2024 84. Disclosure Date: September 13, 2024 85. Disclosure Date: September 13, 2024 86. Disclosure Date: September 13, 2024 87. Disclosure Date: September 13, 2024 88. Disclosure Date: September 13, 2024 89. Disclosure Date: September 13, 2024 90. Disclosure Date: September 13, 2024 91. Disclosure Date: September 13, 2024 92. Disclosure Date: September 13, 2024 93. Disclosure Date: September 13, 2024 94. Disclosure Date: September 13, 2024 95. Disclosure Date: September 13, 2024 96. Disclosure Date: September 13, 2024 97. Disclosure Date: September 13, 2024 98.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2024-5628: Avada WordPress Plugin Contributor Stored XSS via fusion_button Shortcode