What’s Vulnerable › Products
ThemeFusion Avada | Website Builder For WordPress & WooCommerce vulnerabilities
25 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 9 published in the last 12 months.
Latest ThemeFusion Avada | Website Builder For WordPress & WooCommerce vulnerabilities
- CVE-2026-115346 — Avada | Website Builder For WordPress & WooCommerce <= 7.16.2 - Unauthenticated Arbitrary File Upload via Avada Form Upload Field (CVSS 8.1)
- CVE-2026-97340 — Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'author_facebook' User Profile Field (CVSS 6.4)
- CVE-2026-84925 — Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Reflected Cross-Site Scripting via 'lang' Parameter (CVSS 6.1)
- CVE-2026-18431 — Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write (CVSS 9.8)
- CVE-2025-58922 — WordPress Avada theme < 7.13.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- CVE-2025-64634 — WordPress Avada theme <= 7.13.2 - Broken Access Control vulnerability (CVSS 5.3)
- CVE-2025-24748 — WordPress Avada theme <= 7.11.10 - Broken Access Control vulnerability (CVSS 5.3)
- CVE-2024-13346 — Avada Theme <= 7.11.13 - Unauthenticated Arbitrary Shortcode Execution (CVSS 9.8)
- CVE-2024-54357 — WordPress Avada theme <= 7.11.10 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- CVE-2024-5628 — Avada | Website Builder For WordPress & eCommerce <= 3.11.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via fusion_button Shortcode (CVSS 5.4)
- CVE-2023-39312 — WordPress Avada theme <= 7.11.1 - Auth. Unrestricted Zip Extraction vulnerability (CVSS 8.8)
- CVE-2023-39922 — WordPress Avada theme <= 7.11.1 - Authenticated Broken Access Control vulnerability (CVSS 8.8)
- CVE-2024-2344 — Avada <= 7.11.6 - Authenticated (Admin+) SQL Injection via entry (CVSS 7.2)
- CVE-2024-2343 — Avada <= 7.11.6 - Authenticated (Contributor+) Server-Side Request Forgery via form_to_url_action (CVSS 6.4)
- CVE-2024-2340 — Avada <= 7.11.6 - Unauthenticated Sensitive Information Exposure via Form Uploads Directory Listing (CVSS 5.3)
- CVE-2024-2311 — Avada <= 7.11.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 5.4)
- CVE-2023-39313 — WordPress Avada theme <= 7.11.1 - Authenticated Server Side Request Forgery (SSRF) vulnerability (CVSS 7.7)
- CVE-2023-39307 — WordPress Avada theme <= 7.11.1 - Authenticated Arbitrary File Upload vulnerability (CVSS 8.8)
- CVE-2024-1668 — Avada <= 7.11.5 - Authenticated(Contributor+) Sensitive Information Exposure via Form Entries (CVSS 6.5)
- CVE-2024-1468 — Avada | Website Builder For WordPress & WooCommerce <= 7.11.4 - Authenticated (Contributor+) Arbitrary File Upload (CVSS 8.8)
- CVE-2020-36711 — Avada <= 6.2.2 - Authenticated (Contributor+) Cross-Site Scripting (CVSS 5.4)
- CVE-2022-41996 — WordPress Avada premium theme <= 7.8.1 - Cross-Site Request Forgery (CSRF) vulnerability (CVSS 8.8)
- CVE-2022-1386 — Fusion Builder < 3.6.2 - Unauthenticated SSRF (CVSS 9.8)
- CVE-2017-18607 — (CVSS 8.8)
- CVE-2017-18606 — (CVSS 6.1)