ThemeFusion Avada (Fusion) Builder

• CVE-2026-104729 Medium 6.4 Avada (Fusion) Builder <= 3.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tab_index' and 'empty_notice' Shortcode Attributes 0.2%
• CVE-2026-97471 Medium 5.3 Avada (Fusion) Builder <= 3.16.1 - Unauthenticated Sensitive Information Exposure in 'args[link_target]' Parameter via {user_meta} Dynamic Data Token 0.3%
• CVE-2026-97670 Critical 9.1 Avada (Fusion) Builder <= 7.16.1 - Unauthenticated Arbitrary WordPress Action Invocation via '{action_hook}' Dynamic-Data Token in Form Field 0.5%
• CVE-2026-16654 Medium 6.4 Avada (Fusion) Builder <= 3.15.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' Shortcode Attribute 0.3%
• CVE-2026-18431 Critical 9.8 Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write 0.9%
• CVE-2026-12536 Medium 6.4 Avada Builder <= 3.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Title 0.3%
• CVE-2026-8713 Critical 9.1 Avada (Fusion) Builder <= 3.15.3 - Unauthenticated Arbitrary File Deletion via Form Entry Value 3.0%
• CVE-2026-1543 Medium 6.4 Avada (Fusion) Builder <= 3.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Multiple Shortcodes 0.3%
• CVE-2026-6279 Critical 9.8 Avada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler 9.9%
• CVE-2026-4782 Medium 6.5 Avada Builder <= 3.15.2 - Authenticated (Subscriber+) Arbitrary File Read via 'custom_svg' Shortcode Parameter 0.5%
• CVE-2026-4798 High 7.5 Avada Builder <= 3.15.1 - Unauthenticated SQL Injection via 'product_order' Parameter 0.5%
• CVE-2026-1509 Medium 5.4 Avada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Limited Arbitrary WordPress Action Execution 0.3%
• CVE-2026-1541 Medium 4.3 Avada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Sensitive Information Exposure via Insecure Direct Object Reference 0.3%
• CVE-2025-6747 Medium 6.4 Avada (Fusion) Builder <= 3.12.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode 0.2%
• CVE-2025-1665 Medium 6.4 Avada Builder <= 3.11.14 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.3%
• CVE-2024-13345 High 7.3 Avada Builder <= 3.11.13 - Unauthenticated Arbitrary Shortcode Execution 0.5%
• CVE-2024-12477 Medium 6.4 Avada Builder <= 3.11.11 - Authenticated (Contributor+) Stored Cross-Site Scripting in Multiple Widgets 0.2%
• CVE-2024-12335 Medium 4.3 Avada Builder <= 3.11.12 - Authenticated (Contributor+) Protected Post Disclosure 0.4%
• CVE-2024-5628 Medium 6.4 Avada | Website Builder For WordPress & eCommerce <= 3.11.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via fusion_button Shortcode 0.3%