Themefusion Avada vulnerabilities

• themefusion avada | website builder for wordpress & woocommerce Avada | Website Builder For WordPress & WooCommerce <= 7.16.2 - Unauthenticated Arbitrary File Upload via Avada Form Upload Field CVE-2026-115346 8.1 HighOctober 30, 2026
• themefusion avada (fusion) builder Avada (Fusion) Builder <= 3.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tab_index' and 'empty_notice' Shortcode Attributes CVE-2026-104729 6.4 MediumOctober 28, 2026
• themefusion avada (fusion) builder Avada (Fusion) Builder <= 3.16.1 - Unauthenticated Sensitive Information Exposure in 'args[link_target]' Parameter via {user_meta} Dynamic Data Token CVE-2026-97471 5.3 MediumOctober 14, 2026
• themefusion avada | website builder for wordpress & woocommerce Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'author_facebook' User Profile Field CVE-2026-97340 6.4 MediumOctober 10, 2026
• themefusion avada (fusion) builder Avada (Fusion) Builder <= 7.16.1 - Unauthenticated Arbitrary WordPress Action Invocation via '{action_hook}' Dynamic-Data Token in Form Field CVE-2026-97670 9.1 CriticalOctober 10, 2026
• themefusion avada | website builder for wordpress & woocommerce Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Reflected Cross-Site Scripting via 'lang' Parameter CVE-2026-84925 6.1 MediumOctober 2, 2026
• themefusion avada (fusion) builder Avada (Fusion) Builder <= 3.15.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' Shortcode Attribute CVE-2026-16654 6.4 MediumAugust 28, 2026
• themefusion avada (fusion) builder, avada | website builder for wordpress & woocommerce +1 more Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write CVE-2026-18431 Public exploit 9.8 CriticalAugust 26, 2026
• themefusion avada custom branding WordPress Avada Custom Branding plugin <= 1.2 - Broken Access Control vulnerability CVE-2026-65524 4.3 MediumJuly 23, 2026
• avada studio core, themefusion avada core +1 more WordPress Avada Core plugin <= 5.15.6 - Cross Site Request Forgery (CSRF) vulnerability CVE-2026-65471 9.6 CriticalJuly 23, 2026
• themefusion avada (fusion) builder Avada Builder <= 3.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Title CVE-2026-12536 6.4 MediumJuly 13, 2026
• themefusion avada (fusion) builder Avada (Fusion) Builder <= 3.15.3 - Unauthenticated Arbitrary File Deletion via Form Entry Value CVE-2026-8713 Public exploit 9.1 CriticalJune 19, 2026
• themefusion avada (fusion) builder Avada (Fusion) Builder <= 3.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Multiple Shortcodes CVE-2026-1543 6.4 MediumMay 21, 2026
• themefusion avada (fusion) builder Avada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler CVE-2026-6279 Public exploit 9.8 CriticalMay 21, 2026
• themefusion avada (fusion) builder Avada Builder <= 3.15.2 - Authenticated (Subscriber+) Arbitrary File Read via 'custom_svg' Shortcode Parameter CVE-2026-4782 Public exploit 6.5 MediumMay 13, 2026
• themefusion avada (fusion) builder Avada Builder <= 3.15.1 - Unauthenticated SQL Injection via 'product_order' Parameter CVE-2026-4798 7.5 HighMay 13, 2026
• themefusion avada WordPress Avada theme < 7.13.2 - Cross Site Request Forgery (CSRF) vulnerability CVE-2025-58922 4.3 MediumApril 22, 2026
• themefusion avada (fusion) builder Avada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Limited Arbitrary WordPress Action Execution CVE-2026-1509 5.4 MediumApril 15, 2026
• themefusion avada (fusion) builder Avada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Sensitive Information Exposure via Insecure Direct Object Reference CVE-2026-1541 4.3 MediumApril 15, 2026
• themefusion avada core WordPress Avada Core plugin < 5.15.0 - Cross Site Scripting (XSS) vulnerability CVE-2026-32454 6.5 MediumMarch 13, 2026
• themefusion avada core WordPress Avada Core plugin < 5.15.0 - Broken Access Control vulnerability CVE-2026-32453 5.3 MediumMarch 13, 2026
• theme-fusion avada WordPress Avada theme <= 7.13.2 - Broken Access Control vulnerability CVE-2025-64634 5.3 MediumDecember 16, 2025
• themefusion avada (fusion) builder Avada (Fusion) Builder <= 3.12.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2025-6747 6.4 MediumJuly 16, 2025
• themefusion avada WordPress Avada theme <= 7.11.10 - Broken Access Control vulnerability CVE-2025-24748 5.3 MediumJuly 4, 2025
• theme-fusion avada builder, themefusion avada (fusion) builder +1 more Avada Builder <= 3.11.14 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2025-1665 6.4 MediumApril 1, 2025
• theme-fusion avada builder, themefusion avada (fusion) builder +1 more Avada Builder <= 3.11.13 - Unauthenticated Arbitrary Shortcode Execution CVE-2024-13345 7.3 HighFebruary 13, 2025
• theme-fusion avada, themefusion avada | website builder for wordpress & woocommerce +1 more Avada Theme <= 7.11.13 - Unauthenticated Arbitrary Shortcode Execution CVE-2024-13346 Public exploit 7.3 HighFebruary 13, 2025
• theme-fusion avada builder, themefusion avada (fusion) builder +1 more Avada Builder <= 3.11.11 - Authenticated (Contributor+) Stored Cross-Site Scripting in Multiple Widgets CVE-2024-12477 6.4 MediumJanuary 22, 2025
• theme-fusion avada builder, themefusion avada (fusion) builder +1 more Avada Builder <= 3.11.12 - Authenticated (Contributor+) Protected Post Disclosure CVE-2024-12335 4.3 MediumDecember 25, 2024
• theme-fusion avada WordPress Avada theme <= 7.11.10 - Cross Site Request Forgery (CSRF) vulnerability CVE-2024-54357 4.3 MediumDecember 16, 2024
• theme-fusion avada, themefusion avada (fusion) builder +1 more Avada | Website Builder For WordPress & eCommerce <= 3.11.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via fusion_button Shortcode CVE-2024-5628 6.4 MediumSeptember 13, 2024
• theme-fusion avada WordPress Avada theme <= 7.11.1 - Auth. Unrestricted Zip Extraction vulnerability CVE-2023-39312 9.1 CriticalJune 19, 2024
• theme-fusion avada WordPress Avada theme <= 7.11.1 - Authenticated Broken Access Control vulnerability CVE-2023-39922 4.3 MediumJune 19, 2024
• theme-fusion avada, themefusion avada | website builder for wordpress & woocommerce +1 more Avada <= 7.11.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2024-2311 6.4 MediumApril 9, 2024
• theme-fusion avada, themefusion avada | website builder for wordpress & woocommerce +1 more Avada <= 7.11.6 - Authenticated (Admin+) SQL Injection via entry CVE-2024-2344 7.2 HighApril 9, 2024
• theme-fusion avada, themefusion avada | website builder for wordpress & woocommerce +1 more Avada <= 7.11.6 - Unauthenticated Sensitive Information Exposure via Form Uploads Directory Listing CVE-2024-2340 EPSS 28.0% 5.3 MediumApril 9, 2024
• theme-fusion avada, themefusion avada | website builder for wordpress & woocommerce +1 more Avada <= 7.11.6 - Authenticated (Contributor+) Server-Side Request Forgery via form_to_url_action CVE-2024-2343 6.4 MediumApril 9, 2024
• theme-fusion avada WordPress Avada theme <= 7.11.1 - Authenticated Server Side Request Forgery (SSRF) vulnerability CVE-2023-39313 7.7 HighMarch 28, 2024
• theme-fusion avada WordPress Avada theme <= 7.11.1 - Authenticated Arbitrary File Upload vulnerability CVE-2023-39307 8.5 HighMarch 26, 2024
• theme-fusion avada, themefusion avada | website builder for wordpress & woocommerce +1 more Avada <= 7.11.5 - Authenticated(Contributor+) Sensitive Information Exposure via Form Entries CVE-2024-1668 6.5 MediumMarch 13, 2024
• avada website builder, theme-fusion avada, themefusion avada | website builder for wordpress & woocommerce +2 more Avada | Website Builder For WordPress & WooCommerce <= 7.11.4 - Authenticated (Contributor+) Arbitrary File Upload CVE-2024-1468 8.8 HighFebruary 29, 2024
• theme-fusion avada, themefusion avada | website builder for wordpress & woocommerce +1 more Avada <= 6.2.2 - Authenticated (Contributor+) Cross-Site Scripting CVE-2020-36711 6.4 MediumJune 7, 2023
• theme-fusion avada, themefusion avada (premium wordpress theme) +1 more WordPress Avada premium theme <= 7.8.1 - Cross-Site Request Forgery (CSRF) vulnerability CVE-2022-41996 8.8 HighOctober 27, 2022