What’s Vulnerable › Products
themefusion Avada (Fusion) Builder vulnerabilities
17 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 18 published in the last 12 months.
Check whether your themefusion Avada (Fusion) Builder version is affected
Latest themefusion Avada (Fusion) Builder vulnerabilities
- CVE-2026-104729 — Avada (Fusion) Builder <= 3.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tab_index' and 'empty_notice' Shortcode Attributes (CVSS 6.4)
- CVE-2026-97471 — Avada (Fusion) Builder <= 3.16.1 - Unauthenticated Sensitive Information Exposure in 'args[link_target]' Parameter via {user_meta} Dynamic Data Token (CVSS 5.3)
- CVE-2026-97670 — Avada (Fusion) Builder <= 7.16.1 - Unauthenticated Arbitrary WordPress Action Invocation via '{action_hook}' Dynamic-Data Token in Form Field (CVSS 9.1)
- CVE-2026-16654 — Avada (Fusion) Builder <= 3.15.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' Shortcode Attribute (CVSS 6.4)
- CVE-2026-18431 — Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write (CVSS 9.8)
- CVE-2026-12536 — Avada Builder <= 3.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Title (CVSS 6.4)
- CVE-2026-8713 — Avada (Fusion) Builder <= 3.15.3 - Unauthenticated Arbitrary File Deletion via Form Entry Value (CVSS 9.1)
- CVE-2026-6279 — Avada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler (CVSS 9.8)
- CVE-2026-1543 — Avada (Fusion) Builder <= 3.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Multiple Shortcodes (CVSS 6.4)
- CVE-2026-4798 — Avada Builder <= 3.15.1 - Unauthenticated SQL Injection via 'product_order' Parameter (CVSS 7.5)
- CVE-2026-4782 — Avada Builder <= 3.15.2 - Authenticated (Subscriber+) Arbitrary File Read via 'custom_svg' Shortcode Parameter (CVSS 6.5)
- CVE-2026-1541 — Avada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Sensitive Information Exposure via Insecure Direct Object Reference (CVSS 4.3)
- CVE-2026-1509 — Avada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Limited Arbitrary WordPress Action Execution (CVSS 5.4)
- CVE-2025-6747 — Avada (Fusion) Builder <= 3.12.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4)
- CVE-2025-1665 — Avada Builder <= 3.11.14 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 5.4)
- CVE-2024-13345 — Avada Builder <= 3.11.13 - Unauthenticated Arbitrary Shortcode Execution (CVSS 9.8)
- CVE-2024-12477 — Avada Builder <= 3.11.11 - Authenticated (Contributor+) Stored Cross-Site Scripting in Multiple Widgets (CVSS 5.4)
- CVE-2024-12335 — Avada Builder <= 3.11.12 - Authenticated (Contributor+) Protected Post Disclosure (CVSS 4.3)