ThemeFusion Avada | Website Builder For WordPress & WooCommerce

• CVE-2026-115346 High 8.1 Avada | Website Builder For WordPress & WooCommerce <= 7.16.2 - Unauthenticated Arbitrary File Upload via Avada Form Upload Field 0.7%
• CVE-2026-97340 Medium 6.4 Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'author_facebook' User Profile Field 0.2%
• CVE-2026-84925 Medium 6.1 Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Reflected Cross-Site Scripting via 'lang' Parameter 0.2%
• CVE-2026-18431 Critical 9.8 Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write 0.9%
• CVE-2024-13346 High 7.3 Avada Theme <= 7.11.13 - Unauthenticated Arbitrary Shortcode Execution 2.3%
• CVE-2024-2311 Medium 6.4 Avada <= 7.11.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode 0.7%
• CVE-2024-2344 High 7.2 Avada <= 7.11.6 - Authenticated (Admin+) SQL Injection via entry 0.8%
• CVE-2024-2340 Medium 5.3 Avada <= 7.11.6 - Unauthenticated Sensitive Information Exposure via Form Uploads Directory Listing 28.0%
• CVE-2024-2343 Medium 6.4 Avada <= 7.11.6 - Authenticated (Contributor+) Server-Side Request Forgery via form_to_url_action 0.5%
• CVE-2024-1668 Medium 6.5 Avada <= 7.11.5 - Authenticated(Contributor+) Sensitive Information Exposure via Form Entries 0.7%
• CVE-2024-1468 High 8.8 Avada | Website Builder For WordPress & WooCommerce <= 7.11.4 - Authenticated (Contributor+) Arbitrary File Upload 1.2%
• CVE-2020-36711 Medium 6.4 Avada <= 6.2.2 - Authenticated (Contributor+) Cross-Site Scripting 0.6%