# themefusion Avada (Fusion) Builder.

Every CVE that names themefusion Avada (Fusion) Builder among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Avada (Fusion) Builder <= 3.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tab_index' and 'empty_notice' Shortcode Attributes](https://agentprime.io/advisories/CVE-2026-104729.md)
  `CVE-2026-104729` · CVE record: themefusion Avada (Fusion) Builder · CVSS 6.4 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Avada (Fusion) Builder <= 3.16.1 - Unauthenticated Sensitive Information Exposure in 'args\[link_target\]' Parameter via {user_meta} Dynamic Data Token](https://agentprime.io/advisories/CVE-2026-97471.md)
  `CVE-2026-97471` · CVE record: themefusion Avada (Fusion) Builder · CVSS 5.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Information disclosure
- [Avada (Fusion) Builder <= 7.16.1 - Unauthenticated Arbitrary WordPress Action Invocation via '{action_hook}' Dynamic-Data Token in Form Field](https://agentprime.io/advisories/CVE-2026-97670.md)
  `CVE-2026-97670` · CVE record: themefusion Avada (Fusion) Builder · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Code injection
- [Avada (Fusion) Builder <= 3.15.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' Shortcode Attribute](https://agentprime.io/advisories/CVE-2026-16654.md)
  `CVE-2026-16654` · CVE record: themefusion Avada (Fusion) Builder · CVSS 6.4 Medium · Not analysed yet · Published 28 Aug 2026 · Tags: Cross-site scripting (XSS)
- [Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write](https://agentprime.io/advisories/CVE-2026-18431.md)
  `CVE-2026-18431` · CVE record: themefusion Avada (Fusion) Builder and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: Broken access control
- [Avada Builder <= 3.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Title](https://agentprime.io/advisories/CVE-2026-12536.md)
  `CVE-2026-12536` · CVE record: themefusion Avada (Fusion) Builder · CVSS 6.4 Medium · Not analysed yet · Published 13 Jul 2026 · Tags: Cross-site scripting (XSS)
- [Avada (Fusion) Builder <= 3.15.3 - Unauthenticated Arbitrary File Deletion via Form Entry Value](https://agentprime.io/advisories/CVE-2026-8713.md)
  `CVE-2026-8713` · CVE record: themefusion Avada (Fusion) Builder · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Jun 2026 · Tags: Path traversal
- [Avada (Fusion) Builder <= 3.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Multiple Shortcodes](https://agentprime.io/advisories/CVE-2026-1543.md)
  `CVE-2026-1543` · CVE record: themefusion Avada (Fusion) Builder · CVSS 6.4 Medium · Not analysed yet · Published 21 May 2026 · Tags: Cross-site scripting (XSS)
- [Avada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler](https://agentprime.io/advisories/CVE-2026-6279.md)
  `CVE-2026-6279` · CVE record: themefusion Avada (Fusion) Builder · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 May 2026 · Tags: Other injection
- [Avada Builder <= 3.15.2 - Authenticated (Subscriber+) Arbitrary File Read via 'custom_svg' Shortcode Parameter](https://agentprime.io/advisories/CVE-2026-4782.md)
  `CVE-2026-4782` · CVE record: themefusion Avada (Fusion) Builder · CVSS 6.5 Medium · Not analysed yet · Published 13 May 2026 · Tags: Path traversal
- [Avada Builder <= 3.15.1 - Unauthenticated SQL Injection via 'product_order' Parameter](https://agentprime.io/advisories/CVE-2026-4798.md)
  `CVE-2026-4798` · CVE record: themefusion Avada (Fusion) Builder · CVSS 7.5 High · Not analysed yet · Published 13 May 2026 · Tags: SQL injection
- [Avada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Limited Arbitrary WordPress Action Execution](https://agentprime.io/advisories/CVE-2026-1509.md)
  `CVE-2026-1509` · CVE record: themefusion Avada (Fusion) Builder · CVSS 5.4 Medium · Not analysed yet · Published 15 Apr 2026 · Tags: Code injection
- [Avada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Sensitive Information Exposure via Insecure Direct Object Reference](https://agentprime.io/advisories/CVE-2026-1541.md)
  `CVE-2026-1541` · CVE record: themefusion Avada (Fusion) Builder · CVSS 4.3 Medium · Not analysed yet · Published 15 Apr 2026 · Tags: Broken access control
- [Avada (Fusion) Builder <= 3.12.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode](https://agentprime.io/advisories/CVE-2025-6747.md)
  `CVE-2025-6747` · CVE record: themefusion Avada (Fusion) Builder · CVSS 6.4 Medium · Not analysed yet · Published 16 Jul 2025 · Tags: Cross-site scripting (XSS)
- [Avada Builder <= 3.11.14 - Authenticated (Contributor+) Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2025-1665.md)
  `CVE-2025-1665` · CVE record: themefusion Avada (Fusion) Builder · CVSS 6.4 Medium · Not analysed yet · Published 1 Apr 2025 · Tags: Cross-site scripting (XSS)
- [Avada Builder <= 3.11.13 - Unauthenticated Arbitrary Shortcode Execution](https://agentprime.io/advisories/CVE-2024-13345.md)
  `CVE-2024-13345` · CVE record: themefusion Avada (Fusion) Builder · CVSS 7.3 High · Not analysed yet · Published 13 Feb 2025 · Tags: Code injection
- [Avada Builder <= 3.11.11 - Authenticated (Contributor+) Stored Cross-Site Scripting in Multiple Widgets](https://agentprime.io/advisories/CVE-2024-12477.md)
  `CVE-2024-12477` · CVE record: themefusion Avada (Fusion) Builder · CVSS 6.4 Medium · Not analysed yet · Published 22 Jan 2025 · Tags: Cross-site scripting (XSS)
- [Avada Builder <= 3.11.12 - Authenticated (Contributor+) Protected Post Disclosure](https://agentprime.io/advisories/CVE-2024-12335.md)
  `CVE-2024-12335` · CVE record: themefusion Avada (Fusion) Builder · CVSS 4.3 Medium · Not analysed yet · Published 25 Dec 2024 · Tags: Broken access control
- [Avada | Website Builder For WordPress & eCommerce <= 3.11.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via fusion_button Shortcode](https://agentprime.io/advisories/CVE-2024-5628.md)
  `CVE-2024-5628` · CVE record: themefusion Avada (Fusion) Builder · CVSS 6.4 Medium · Not analysed yet · Published 13 Sept 2024 · Tags: Cross-site scripting (XSS)

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=themefusion-avada-fusion-builder>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/themefusion-avada-fusion-builder/>. Everything for agents: <https://agentprime.io/llms.txt>.