CVE-2026-104729 | meFusion Avada Builder Plugin up to 3.16.2 on WordPress Shortcode Attribute tab_index/empty_notice cross site scripting

October 28, 2026 Yanac

A vulnerability was found in meFusion Avada Builder Plugin up to 3.16.2 on WordPress. It has been classified as problematic. This issue affects some unknown processing of the component Shortcode Attribute Handler. Performing a manipulation of the argument tab_index/empty_notice results in cross site scripting.

This vulnerability is identified as CVE-2026-104729. The attack can be initiated remotely. There is not any exploit available.VulDB Recent EntriesRead More