CVE-2026-65524 | Medium | 4.3 | 2026-07-23 | Contributor Broken Access Control in Avada Custom Branding <= 1.2 versions. |
CVE-2026-12536 | Medium | 6.4 | 2026-07-13 | The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Module Title’ parameter in all versions up to, and includ… |
CVE-2026-56008 | High | 8.8 | 2026-06-26 | Contributor Privilege Escalation in Fusion Builder <= 3.15.4 versions. |
CVE-2026-8713 | Critical | 9.1 | 2026-06-19 | The Avada (Fusion) Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the maybe_delete_files fun… |
CVE-2026-54193 | High | 7.7 | 2026-06-17 | Contributor Arbitrary File Deletion in Fusion Builder <= 3.15.4 versions. |
CVE-2026-54194 | Critical | 9.8 | 2026-06-17 | Contributor PHP Object Injection in Fusion Builder <= 3.15.4 versions. |
CVE-2026-12256 | High | 8.8 | 2026-06-17 | Contributor PHP Object Injection in Avada <= 3.15.3 versions. |
CVE-2026-6279 | Critical | 9.8 | 2026-05-21 | The Avada Builder (fusion-builder) plugin for WordPress is vulnerable to Unauthenticated Remote Code Execution via PHP Function Injection in versions up to and… |
CVE-2026-1543 | Medium | 6.4 | 2026-05-21 | The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcodes in all versions up to, and including, 3.15… |
CVE-2026-4798 | High | 7.5 | 2026-05-13 | The Avada Builder plugin for WordPress is vulnerable to time-based SQL Injection via the ‘product_order’ parameter in all versions up to, and including, 3.15.1… |
CVE-2026-4782 | Medium | 6.5 | 2026-05-13 | The Avada Builder plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.15.2 via the 'fusion_get_svg_from_file' fun… |
CVE-2025-58922 | Medium | 4.3 | 2026-04-22 | Cross-Site Request Forgery (CSRF) vulnerability in ThemeFusion Avada allows Cross Site Request Forgery.This issue affects Avada: from n/a before 7.13.2. |
CVE-2026-1541 | Medium | 4.3 | 2026-04-15 | The Avada (Fusion) Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.15.1. This is due to th… |
CVE-2026-1509 | Medium | 5.4 | 2026-04-15 | The Avada (Fusion) Builder plugin for WordPress is vulnerable to Arbitrary WordPress Action Execution in all versions up to, and including, 3.15.1. This is due… |
CVE-2026-32542 | High | 7.1 | 2026-03-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeFusion Fusion Builder fusion-builder allows Reflecte… |
CVE-2026-32454 | Medium | 6.5 | 2026-03-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeFusion Avada Core fusion-core allows DOM-Based XSS.T… |
CVE-2026-32453 | Medium | 5.3 | 2026-03-13 | Missing Authorization vulnerability in ThemeFusion Avada Core fusion-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue af… |
CVE-2026-32452 | Medium | 5.3 | 2026-03-13 | Missing Authorization vulnerability in ThemeFusion Fusion Builder fusion-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2026-32451 | Medium | 6.5 | 2026-03-13 | Missing Authorization vulnerability in ThemeFusion Fusion Builder fusion-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2026-25472 | Medium | 6.5 | 2026-02-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeFusion Fusion Builder fusion-builder allows Stored X… |
CVE-2025-64634 | Medium | 5.3 | 2025-12-16 | Missing Authorization vulnerability in ThemeFusion Avada avada allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Avada: from n… |
CVE-2025-49940 | Medium | 6.5 | 2025-10-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeFusion Fusion Builder fusion-builder allows DOM-Base… |
CVE-2025-6747 | Medium | 6.4 | 2025-07-16 | The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fusion_map' shortcode in all versions up to, and… |
CVE-2025-24748 | Medium | 5.3 | 2025-07-04 | Missing Authorization vulnerability in ThemeFusion Avada avada.This issue affects Avada: from n/a through <= 7.11.10. |
CVE-2025-1665 | Medium | 6.4 | 2025-04-01 | The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of the plugin's shortcodes in all versions up to, and… |
CVE-2024-13346 | High | 7.3 | 2025-02-13 | The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including… |
CVE-2024-13345 | High | 7.3 | 2025-02-13 | The Avada Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.11.13. This is due to the softwar… |
CVE-2024-12477 | Medium | 6.4 | 2025-01-22 | The Avada Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 3.11.11 d… |
CVE-2024-12335 | Medium | 4.3 | 2024-12-25 | The Avada (Fusion) Builder plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.11.12 via the handle_clone_post()… |
CVE-2024-54357 | Medium | 4.3 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in ThemeFusion Avada avada.This issue affects Avada: from n/a through <= 7.11.10. |
CVE-2024-5628 | Medium | 6.4 | 2024-09-13 | The Avada | Website Builder For WordPress & eCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's fusion_button shortcod… |
CVE-2023-39312 | Critical | 9.1 | 2024-06-19 | Missing Authorization vulnerability in ThemeFusion Avada.This issue affects Avada: from n/a through 7.11.1. |
CVE-2023-39310 | Medium | 5.4 | 2024-06-19 | Missing Authorization vulnerability in ThemeFusion Fusion Builder.This issue affects Fusion Builder: from n/a through 3.11.1. |
CVE-2023-39922 | Medium | 4.3 | 2024-06-19 | Missing Authorization vulnerability in ThemeFusion Avada.This issue affects Avada: from n/a through 7.11.1. |
CVE-2024-2344 | High | 7.2 | 2024-04-09 | The Avada theme for WordPress is vulnerable to SQL Injection via the 'entry' parameter in all versions up to, and including, 7.11.6 due to insufficient escapin… |
CVE-2024-2343 | Medium | 6.4 | 2024-04-09 | The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including… |
CVE-2024-2340 | Medium | 5.3 | 2024-04-09 | The Avada theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.11.6 via the '/wp-content/uploads/fusion-… |
CVE-2024-2311 | Medium | 6.4 | 2024-04-09 | The Avada theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 7.11.6 due to insu… |
CVE-2023-39309 | High | 8.5 | 2024-03-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ThemeFusion Fusion Builder.This issue affects Fusion Buil… |
CVE-2023-39313 | High | 7.7 | 2024-03-28 | Server-Side Request Forgery (SSRF) vulnerability in ThemeFusion Avada.This issue affects Avada: from n/a through 7.11.1. |
CVE-2023-39311 | High | 7.1 | 2024-03-27 | Cross-Site Request Forgery (CSRF) vulnerability in ThemeFusion Fusion Builder.This issue affects Fusion Builder: from n/a through 3.11.1. |
CVE-2023-39306 | High | 7.1 | 2024-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeFusion Fusion Builder allows Reflected XSS.This issu… |
CVE-2023-39307 | High | 8.5 | 2024-03-26 | Unrestricted Upload of File with Dangerous Type vulnerability in ThemeFusion Avada.This issue affects Avada: from n/a through 7.11.1. |
CVE-2024-1668 | Medium | 6.5 | 2024-03-13 | The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Sensitive Information Exposure in versions up to and including 7.1… |
CVE-2024-1468 | High | 8.8 | 2024-02-29 | The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the… |
CVE-2020-36711 | Medium | 6.4 | 2023-06-07 | The Avada theme for WordPress is vulnerable to Stored Cross-Site Scripting via the update_layout function in versions up to, and including, 6.2.3 due to insuff… |
CVE-2022-41996 | High | 8.8 | 2022-10-27 | Cross-Site Request Forgery (CSRF) vulnerability in ThemeFusion Avada premium theme versions <= 7.8.1 on WordPress leading to arbitrary plugin installation/acti… |