Log in Start free

ThemeFusion

Products

ProductCVEsExploitedLatest
Avada (Fusion) Builder19–Oct 28, 2026
Fusion Builder13–Jun 26, 2026
Avada | Website Builder For WordPress & WooCommerce12–Oct 30, 2026
Avada8–Apr 22, 2026
Avada Core2–Mar 13, 2026
Avada Custom Branding1–Jul 23, 2026
Avada (premium WordPress theme)1–Oct 27, 2022

Exploited and recent CVEs

  • CVE-2026-115346 High 8.1 Avada | Website Builder For WordPress & WooCommerce <= 7.16.2 - Unauthenticated Arbitrary File Upload via Avada Form Upload Field 0.7%
  • CVE-2026-104729 Medium 6.4 Avada (Fusion) Builder <= 3.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tab_index' and 'empty_notice' Shortcode Attributes 0.2%
  • CVE-2026-97471 Medium 5.3 Avada (Fusion) Builder <= 3.16.1 - Unauthenticated Sensitive Information Exposure in 'args[link_target]' Parameter via {user_meta} Dynamic Data Token 0.3%
  • CVE-2026-97340 Medium 6.4 Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'author_facebook' User Profile Field 0.2%
  • CVE-2026-97670 Critical 9.1 Avada (Fusion) Builder <= 7.16.1 - Unauthenticated Arbitrary WordPress Action Invocation via '{action_hook}' Dynamic-Data Token in Form Field 0.5%
  • CVE-2026-84925 Medium 6.1 Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Reflected Cross-Site Scripting via 'lang' Parameter 0.2%
  • CVE-2026-16654 Medium 6.4 Avada (Fusion) Builder <= 3.15.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' Shortcode Attribute 0.3%
  • CVE-2026-18431 Critical 9.8 Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write 0.9%
  • CVE-2026-18431 Critical 9.8 Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write 0.9%
  • CVE-2026-65524 Medium 4.3 WordPress Avada Custom Branding plugin <= 1.2 - Broken Access Control vulnerability 0.3%
  • CVE-2026-12536 Medium 6.4 Avada Builder <= 3.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Title 0.3%
  • CVE-2026-56008 High 8.8 WordPress Fusion Builder plugin <= 3.15.4 - Privilege Escalation vulnerability 0.4%
  • CVE-2026-8713 Critical 9.1 Avada (Fusion) Builder <= 3.15.3 - Unauthenticated Arbitrary File Deletion via Form Entry Value 3.0%
  • CVE-2026-54193 High 7.7 WordPress Fusion Builder plugin <= 3.15.4 - Arbitrary File Deletion vulnerability 0.3%
  • CVE-2026-12256 High 8.8 WordPress Fusion Builder plugin <= 3.15.3 - PHP Object Injection vulnerability 0.5%
  • CVE-2026-54194 Critical 9.8 WordPress Fusion Builder plugin <= 3.15.4 - PHP Object Injection vulnerability 0.4%
  • CVE-2026-1543 Medium 6.4 Avada (Fusion) Builder <= 3.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Multiple Shortcodes 0.3%
  • CVE-2026-6279 Critical 9.8 Avada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler 9.9%
  • CVE-2026-4782 Medium 6.5 Avada Builder <= 3.15.2 - Authenticated (Subscriber+) Arbitrary File Read via 'custom_svg' Shortcode Parameter 0.5%
  • CVE-2026-4798 High 7.5 Avada Builder <= 3.15.1 - Unauthenticated SQL Injection via 'product_order' Parameter 0.5%
  • CVE-2025-58922 Medium 4.3 WordPress Avada theme < 7.13.2 - Cross Site Request Forgery (CSRF) vulnerability 0.1%
  • CVE-2026-1509 Medium 5.4 Avada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Limited Arbitrary WordPress Action Execution 0.3%
  • CVE-2026-1541 Medium 4.3 Avada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Sensitive Information Exposure via Insecure Direct Object Reference 0.3%
  • CVE-2026-32542 High 7.1 WordPress Fusion Builder plugin < 3.15.0 - Reflected Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2026-32454 Medium 6.5 WordPress Avada Core plugin < 5.15.0 - Cross Site Scripting (XSS) vulnerability 0.1%
  • CVE-2026-32453 Medium 5.3 WordPress Avada Core plugin < 5.15.0 - Broken Access Control vulnerability 0.2%
  • CVE-2026-32452 Medium 5.3 WordPress Fusion Builder plugin < 3.15.0 - Broken Access Control vulnerability 0.2%
  • CVE-2026-32451 Medium 6.5 WordPress Fusion Builder plugin < 3.15.0 - Broken Access Control vulnerability 0.2%
  • CVE-2026-25472 Medium 6.5 WordPress Fusion Builder plugin <= 3.14.1 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2025-64634 Medium 5.3 WordPress Avada theme <= 7.13.2 - Broken Access Control vulnerability 0.3%