Theme-fusion Avada vulnerabilities

• theme-fusion avada WordPress Avada theme <= 7.13.2 - Broken Access Control vulnerability CVE-2025-64634 5.3 MediumDecember 16, 2025
• theme-fusion avada builder, themefusion avada (fusion) builder +1 more Avada Builder <= 3.11.14 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2025-1665 6.4 MediumApril 1, 2025
• theme-fusion avada builder, themefusion avada (fusion) builder +1 more Avada Builder <= 3.11.13 - Unauthenticated Arbitrary Shortcode Execution CVE-2024-13345 7.3 HighFebruary 13, 2025
• theme-fusion avada, themefusion avada | website builder for wordpress & woocommerce +1 more Avada Theme <= 7.11.13 - Unauthenticated Arbitrary Shortcode Execution CVE-2024-13346 Public exploit 7.3 HighFebruary 13, 2025
• theme-fusion avada builder, themefusion avada (fusion) builder +1 more Avada Builder <= 3.11.11 - Authenticated (Contributor+) Stored Cross-Site Scripting in Multiple Widgets CVE-2024-12477 6.4 MediumJanuary 22, 2025
• theme-fusion avada builder, themefusion avada (fusion) builder +1 more Avada Builder <= 3.11.12 - Authenticated (Contributor+) Protected Post Disclosure CVE-2024-12335 4.3 MediumDecember 25, 2024
• theme-fusion avada WordPress Avada theme <= 7.11.10 - Cross Site Request Forgery (CSRF) vulnerability CVE-2024-54357 4.3 MediumDecember 16, 2024
• theme-fusion avada, themefusion avada (fusion) builder +1 more Avada | Website Builder For WordPress & eCommerce <= 3.11.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via fusion_button Shortcode CVE-2024-5628 6.4 MediumSeptember 13, 2024
• theme-fusion avada WordPress Avada theme <= 7.11.1 - Auth. Unrestricted Zip Extraction vulnerability CVE-2023-39312 9.1 CriticalJune 19, 2024
• theme-fusion avada WordPress Avada theme <= 7.11.1 - Authenticated Broken Access Control vulnerability CVE-2023-39922 4.3 MediumJune 19, 2024
• theme-fusion avada, themefusion avada | website builder for wordpress & woocommerce +1 more Avada <= 7.11.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2024-2311 6.4 MediumApril 9, 2024
• theme-fusion avada, themefusion avada | website builder for wordpress & woocommerce +1 more Avada <= 7.11.6 - Authenticated (Admin+) SQL Injection via entry CVE-2024-2344 7.2 HighApril 9, 2024
• theme-fusion avada, themefusion avada | website builder for wordpress & woocommerce +1 more Avada <= 7.11.6 - Unauthenticated Sensitive Information Exposure via Form Uploads Directory Listing CVE-2024-2340 EPSS 28.0% 5.3 MediumApril 9, 2024
• theme-fusion avada, themefusion avada | website builder for wordpress & woocommerce +1 more Avada <= 7.11.6 - Authenticated (Contributor+) Server-Side Request Forgery via form_to_url_action CVE-2024-2343 6.4 MediumApril 9, 2024
• theme-fusion avada WordPress Avada theme <= 7.11.1 - Authenticated Server Side Request Forgery (SSRF) vulnerability CVE-2023-39313 7.7 HighMarch 28, 2024
• theme-fusion avada WordPress Avada theme <= 7.11.1 - Authenticated Arbitrary File Upload vulnerability CVE-2023-39307 8.5 HighMarch 26, 2024
• theme-fusion avada, themefusion avada | website builder for wordpress & woocommerce +1 more Avada <= 7.11.5 - Authenticated(Contributor+) Sensitive Information Exposure via Form Entries CVE-2024-1668 6.5 MediumMarch 13, 2024
• avada website builder, theme-fusion avada, themefusion avada | website builder for wordpress & woocommerce +2 more Avada | Website Builder For WordPress & WooCommerce <= 7.11.4 - Authenticated (Contributor+) Arbitrary File Upload CVE-2024-1468 8.8 HighFebruary 29, 2024
• theme-fusion avada, themefusion avada | website builder for wordpress & woocommerce +1 more Avada <= 6.2.2 - Authenticated (Contributor+) Cross-Site Scripting CVE-2020-36711 6.4 MediumJune 7, 2023
• theme-fusion avada, themefusion avada (premium wordpress theme) +1 more WordPress Avada premium theme <= 7.8.1 - Cross-Site Request Forgery (CSRF) vulnerability CVE-2022-41996 8.8 HighOctober 27, 2022
• fusion builder project builder, theme-fusion avada, themefusion fusion builder +2 more Fusion Builder < 3.6.2 - Unauthenticated SSRF CVE-2022-1386 Public exploit EPSS 71.4% 9.8 CriticalMay 16, 2022
• theme-fusion avada The avada theme before 5.1.5 for WordPress has CSRF. CVE-2017-18607 8.8 HighSeptember 10, 2019
• theme-fusion avada The avada theme before 5.1.5 for WordPress has stored XSS. CVE-2017-18606 6.1 MediumSeptember 10, 2019