Theme-fusion Avada
19 CVEs affecting Theme-fusion Avada. Latest disclosed: 2025-12-16. Critical: 2, High: 7.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-1386 | Critical | 9.8 | 2022-05-16 | The Fusion Builder WordPress plugin before 3.6.2, used in the Avada theme, does not validate a parameter in its forms which could be used to initiate arbitrary… |
CVE-2023-39312 | Critical | 9.1 | 2024-06-19 | Missing Authorization vulnerability in ThemeFusion Avada.This issue affects Avada: from n/a through 7.11.1. |
CVE-2024-1468 | High | 8.8 | 2024-02-29 | The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the… |
CVE-2022-41996 | High | 8.8 | 2022-10-27 | Cross-Site Request Forgery (CSRF) vulnerability in ThemeFusion Avada premium theme versions <= 7.8.1 on WordPress leading to arbitrary plugin installation/acti… |
CVE-2017-18607 | High | 8.8 | 2019-09-10 | The avada theme before 5.1.5 for WordPress has CSRF. |
CVE-2023-39307 | High | 8.5 | 2024-03-26 | Unrestricted Upload of File with Dangerous Type vulnerability in ThemeFusion Avada.This issue affects Avada: from n/a through 7.11.1. |
CVE-2023-39313 | High | 7.7 | 2024-03-28 | Server-Side Request Forgery (SSRF) vulnerability in ThemeFusion Avada.This issue affects Avada: from n/a through 7.11.1. |
CVE-2024-13346 | High | 7.3 | 2025-02-13 | The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including… |
CVE-2024-2344 | High | 7.2 | 2024-04-09 | The Avada theme for WordPress is vulnerable to SQL Injection via the 'entry' parameter in all versions up to, and including, 7.11.6 due to insufficient escapin… |
CVE-2024-1668 | Medium | 6.5 | 2024-03-13 | The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Sensitive Information Exposure in versions up to and including 7.1… |
CVE-2024-5628 | Medium | 6.4 | 2024-09-13 | The Avada | Website Builder For WordPress & eCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's fusion_button shortcod… |
CVE-2024-2343 | Medium | 6.4 | 2024-04-09 | The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including… |
CVE-2024-2311 | Medium | 6.4 | 2024-04-09 | The Avada theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 7.11.6 due to insu… |
CVE-2020-36711 | Medium | 6.4 | 2023-06-07 | The Avada theme for WordPress is vulnerable to Stored Cross-Site Scripting via the update_layout function in versions up to, and including, 6.2.3 due to insuff… |
CVE-2017-18606 | Medium | 6.1 | 2019-09-10 | The avada theme before 5.1.5 for WordPress has stored XSS. |
CVE-2025-64634 | Medium | 5.3 | 2025-12-16 | Missing Authorization vulnerability in ThemeFusion Avada avada allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Avada: from n… |
CVE-2024-2340 | Medium | 5.3 | 2024-04-09 | The Avada theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.11.6 via the '/wp-content/uploads/fusion-… |
CVE-2024-54357 | Medium | 4.3 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in ThemeFusion Avada avada.This issue affects Avada: from n/a through <= 7.11.10. |
CVE-2023-39922 | Medium | 4.3 | 2024-06-19 | Missing Authorization vulnerability in ThemeFusion Avada.This issue affects Avada: from n/a through 7.11.1. |