try this in child-theme functions.php:

function custom_replace_burger_anchor_with_button( $items, $args ){ 
    $pattern = '/(<li[^>]*class="[^"]*av-burger-menu-main[^"]*"[^>]*>)\s*<a([^>]*)>/is';
    $items = preg_replace($pattern, '$1<button type="button" $2>', $items);
    $items = preg_replace('/<\/a>(\s*<\/li>\s*$)/', '</button>$1', $items);
    return $items;
}
add_filter( 'wp_nav_menu_items', 'custom_replace_burger_anchor_with_button', 9999, 2 );

BUT: Please note that in this case, you will no longer need to assign all styles to the a tag, but rather to the button tag.
In this case, it might be better to use role=”button” and class=avia-button.

function custom_enhance_burger_anchor_regex( $items, $args ) {
    $pattern = '/<a href="#" aria-label="(.*?)"/i';
    $replacement = '<a href="#" role="button" class="avia-button" aria-label="$1"';  
    $items = preg_replace($pattern, $replacement, $items);
    return $items;
}
add_filter( 'wp_nav_menu_items', 'custom_enhance_burger_anchor_regex', 9999, 2 );

No CSS break: Since it remains an anchor-tag, all Enfold styles for the menu continue to work perfectly.
A11y-compliant: With role=”button,” we tell the screen reader: “Ignore that there is a link here; treat this element like a button.”

maybe it is better to not add the class avia-button because it might come into conflict with some stylings.
use a different class there f.e.: avia-burger-button
then you can easily select it via this class.

First of all, the icon is marked with aria-label=“Menu,” which is best practice.

And to understand your question correctly, they consider an anchor tag with such a label to be misleading?
So you would prefer it to be like this?

by the way – all enfold buttons do not have the button tag – they got that extra-class : avia-button

try in your child-theme functions.php:

function ava_custom_toggle_behavior(){
?>
<script type="text/javascript">
(function($) {
    $(window).on('load', function() {
        $('.toggler').on('click', function() {
            var $current = $(this);
            
            // Short delay so Enfold can set its own classes
            setTimeout(function() {
                if ($current.hasClass('activeTitle')) {
                    // Find all other togglers on the page that are active
                    $('.toggler').not($current).each(function() {
                        if ($(this).hasClass('activeTitle')) {
                            // Simulate click or remove classes manually
                            $(this).trigger('click');
                        }
                    });
                }
            }, 100);
        });
    });
})(jQuery);
</script>
<?php
}
add_action('wp_footer', 'ava_custom_toggle_behavior');

or even better – just use the team-member element as it is and parse a popup by your own.
see with snippet on that example page: https://webers-testseite.de/teammember-vitae-2/
PS: It is always best to examine each individual case closely, as this is the only way to offer a customized solution. Otherwise, one indulges in speculation.

The last solution has the advantage that you only use the pure Enfold element for team members and then create your own lightbox with it. Disadvantage: you would have to rebuild your page and discard our previous design. In the window on the right side of the page, you can see that only plain text is entered in the Description Input Fiele — the Lightbox retrieves the image, name, and position from the existing DOM elements.
To change the aria-label – just edit these lines:

tPrev: 'Previous Biography',
tNext: 'Next Biography',

Hi

I too have had a message about the 7.1.3 Enfold Cross Site Scripting (XSS) vulnerability

Please advise

Thank you
Nick

Solutions
This security issue has a low severity impact and is unlikely to be exploited.

maybe it is not so urgent ;)

____________________
Perhaps it’s time to introduce a nonce solution for all Enfold scripts?
(for my own i have written a small plugin that will bring to every script/inline-script a nonce-key; and my csp directive says:
script-src ‘nonce-key==’ ‘strict-dynamic’ ) that is the best against XSS – and check f.e. on: https://securityheaders.com/?q=https%3A%2F%2Fwebers-testseite.de&followRedirects=on )

there is a globaly set rule on enfold :

.container_wrap {
  clear:both;
  position:relative;
  border-top-style:solid;
  border-top-width:1px
}

Personally, I consider them unnecessary. This is what I set on my installation:

#top .container_wrap {
  border: none !important;
}

But that’s actually a well-known problem.

Hi Ismael,
Sorry, but you have a current new security vulnerability that was published three days ago on Patchstack! And not the vulnerability that was fixed with 7.1.3 in October 2025!
https://patchstack.com/database/wordpress/theme/enfold/vulnerability/wordpress-enfold-theme-7-1-3-cross-site-scripting-xss-vulnerability

So please check and fix it quickly and deliver an appropriate version.