What’s Vulnerable › Products

ThemeFusion Fusion Builder vulnerabilities

13 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 9 published in the last 12 months.

Check whether your ThemeFusion Fusion Builder version is affected

Latest ThemeFusion Fusion Builder vulnerabilities

• CVE-2026-56008 — WordPress Fusion Builder plugin <= 3.15.4 - Privilege Escalation vulnerability (CVSS 8.8)
• CVE-2026-54193 — WordPress Fusion Builder plugin <= 3.15.4 - Arbitrary File Deletion vulnerability (CVSS 7.7)
• CVE-2026-54194 — WordPress Fusion Builder plugin <= 3.15.4 - PHP Object Injection vulnerability (CVSS 9.8)
• CVE-2026-12256 — WordPress Fusion Builder plugin <= 3.15.3 - PHP Object Injection vulnerability (CVSS 8.8)
• CVE-2026-32542 — WordPress Fusion Builder plugin < 3.15.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
• CVE-2026-32452 — WordPress Fusion Builder plugin < 3.15.0 - Broken Access Control vulnerability (CVSS 5.3)
• CVE-2026-32451 — WordPress Fusion Builder plugin < 3.15.0 - Broken Access Control vulnerability (CVSS 6.5)
• CVE-2026-25472 — WordPress Fusion Builder plugin <= 3.14.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
• CVE-2025-49940 — WordPress Fusion Builder plugin <= 3.13.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
• CVE-2023-39310 — WordPress Avada Builder plugin <= 3.11.1 - Authenticated Broken Access Control vulnerability (CVSS 5.4)
• CVE-2023-39309 — WordPress Avada Builder plugin <= 3.11.1 - Auth. SQL Injection vulnerability (CVSS 8.8)
• CVE-2023-39311 — WordPress Avada Builder plugin <= 3.11.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 8.8)
• CVE-2023-39306 — WordPress Avada Builder plugin <= 3.11.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)