Skip to contentThemefusion Avada (fusion) Builder vulnerabilities
- themefusion avada (fusion) builderAvada (Fusion) Builder <= 3.16.1 - Unauthenticated Stored Cross-Site Scripting via Form Notification Dynamic-Data action_hookCVE-2026-849387.2 High
- themefusion avada (fusion) builderAvada (Fusion) Builder <= 3.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tab_index' and 'empty_notice' Shortcode AttributesCVE-2026-1047296.4 Medium
- themefusion avada (fusion) builderAvada (Fusion) Builder <= 3.16.1 - Unauthenticated Sensitive Information Exposure in 'args[link_target]' Parameter via {user_meta} Dynamic Data TokenCVE-2026-974715.3 Medium
- themefusion avada (fusion) builderAvada (Fusion) Builder <= 7.16.1 - Unauthenticated Arbitrary WordPress Action Invocation via '{action_hook}' Dynamic-Data Token in Form FieldCVE-2026-976709.1 Critical
- themefusion avada (fusion) builderAvada (Fusion) Builder <= 3.15.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' Shortcode AttributeCVE-2026-166546.4 Medium
- themefusion avada (fusion) builder, avada | website builder for wordpress & woocommerce +1 moreAvada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File WriteCVE-2026-18431Public exploit9.8 Critical
- themefusion avada (fusion) builderAvada Builder <= 3.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module TitleCVE-2026-125366.4 Medium
- themefusion avada (fusion) builderAvada (Fusion) Builder <= 3.15.3 - Unauthenticated Arbitrary File Deletion via Form Entry ValueCVE-2026-8713Public exploit9.1 Critical
- themefusion avada (fusion) builderAvada (Fusion) Builder <= 3.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Multiple ShortcodesCVE-2026-15436.4 Medium
- themefusion avada (fusion) builderAvada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX HandlerCVE-2026-6279Public exploit9.8 Critical
- themefusion avada (fusion) builderAvada Builder <= 3.15.2 - Authenticated (Subscriber+) Arbitrary File Read via 'custom_svg' Shortcode ParameterCVE-2026-47826.5 Medium
- themefusion avada (fusion) builderAvada Builder <= 3.15.1 - Unauthenticated SQL Injection via 'product_order' ParameterCVE-2026-47987.5 High
- themefusion avada (fusion) builderAvada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Limited Arbitrary WordPress Action ExecutionCVE-2026-15095.4 Medium
- themefusion avada (fusion) builderAvada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Sensitive Information Exposure via Insecure Direct Object ReferenceCVE-2026-15414.3 Medium
- themefusion avada (fusion) builderAvada (Fusion) Builder <= 3.12.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeCVE-2025-67476.4 Medium
- theme-fusion avada builder, themefusion avada (fusion) builder +1 moreAvada Builder <= 3.11.14 - Authenticated (Contributor+) Stored Cross-Site ScriptingCVE-2025-16656.4 Medium
- theme-fusion avada builder, themefusion avada (fusion) builder +1 moreAvada Builder <= 3.11.13 - Unauthenticated Arbitrary Shortcode ExecutionCVE-2024-133457.3 High
- theme-fusion avada builder, themefusion avada (fusion) builder +1 moreAvada Builder <= 3.11.11 - Authenticated (Contributor+) Stored Cross-Site Scripting in Multiple WidgetsCVE-2024-124776.4 Medium
- theme-fusion avada builder, themefusion avada (fusion) builder +1 moreAvada Builder <= 3.11.12 - Authenticated (Contributor+) Protected Post DisclosureCVE-2024-123354.3 Medium
- theme-fusion avada, themefusion avada (fusion) builder +1 moreAvada | Website Builder For WordPress & eCommerce <= 3.11.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via fusion_button ShortcodeCVE-2024-56286.4 Medium