Advisories · Technology
themefusion Avada (Fusion) Builder.
Every CVE that names themefusion Avada (Fusion) Builder among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.4 Medium
Avada (Fusion) Builder <= 3.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tab_index' and 'empty_notice' Shortcode Attributes
- themefusion Avada (Fusion) Builder
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Avada (Fusion) Builder <= 3.16.1 - Unauthenticated Sensitive Information Exposure in 'args[link_target]' Parameter via {user_meta} Dynamic Data Token
- themefusion Avada (Fusion) Builder
- Information disclosure
- CVSS 9.1 CriticalCritical · CVSS 9+
Avada (Fusion) Builder <= 7.16.1 - Unauthenticated Arbitrary WordPress Action Invocation via '{action_hook}' Dynamic-Data Token in Form Field
- themefusion Avada (Fusion) Builder
- Code injection
- CVSS 6.4 Medium
Avada (Fusion) Builder <= 3.15.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' Shortcode Attribute
- themefusion Avada (Fusion) Builder
- Cross-site scripting (XSS)
- CVSS 9.8 CriticalCritical · CVSS 9+
Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write
- themefusion Avada (Fusion) Builder
- ThemeFusion Avada | Website Builder For WordPress & WooCommerce
- Broken access control
- CVSS 6.4 Medium
Avada Builder <= 3.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Title
- themefusion Avada (Fusion) Builder
- Cross-site scripting (XSS)
- CVSS 9.1 CriticalCritical · CVSS 9+
Avada (Fusion) Builder <= 3.15.3 - Unauthenticated Arbitrary File Deletion via Form Entry Value
- themefusion Avada (Fusion) Builder
- Path traversal
- CVSS 6.4 Medium
Avada (Fusion) Builder <= 3.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Multiple Shortcodes
- themefusion Avada (Fusion) Builder
- Cross-site scripting (XSS)
- CVSS 9.8 CriticalCritical · CVSS 9+
Avada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler
- themefusion Avada (Fusion) Builder
- Other injection
- CVSS 6.5 Medium
Avada Builder <= 3.15.2 - Authenticated (Subscriber+) Arbitrary File Read via 'custom_svg' Shortcode Parameter
- themefusion Avada (Fusion) Builder
- Path traversal
- CVSS 7.5 High
Avada Builder <= 3.15.1 - Unauthenticated SQL Injection via 'product_order' Parameter
- themefusion Avada (Fusion) Builder
- SQL injection
- CVSS 5.4 Medium
Avada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Limited Arbitrary WordPress Action Execution
- themefusion Avada (Fusion) Builder
- Code injection
- CVSS 4.3 Medium
Avada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Sensitive Information Exposure via Insecure Direct Object Reference
- themefusion Avada (Fusion) Builder
- Broken access control
- CVSS 6.4 Medium
Avada (Fusion) Builder <= 3.12.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- themefusion Avada (Fusion) Builder
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Avada Builder <= 3.11.14 - Authenticated (Contributor+) Stored Cross-Site Scripting
- themefusion Avada (Fusion) Builder
- Cross-site scripting (XSS)
- CVSS 7.3 High
Avada Builder <= 3.11.13 - Unauthenticated Arbitrary Shortcode Execution
- themefusion Avada (Fusion) Builder
- Code injection
- CVSS 6.4 Medium
Avada Builder <= 3.11.11 - Authenticated (Contributor+) Stored Cross-Site Scripting in Multiple Widgets
- themefusion Avada (Fusion) Builder
- Cross-site scripting (XSS)
- CVSS 4.3 Medium
Avada Builder <= 3.11.12 - Authenticated (Contributor+) Protected Post Disclosure
- themefusion Avada (Fusion) Builder
- Broken access control
- CVSS 6.4 Medium
Avada | Website Builder For WordPress & eCommerce <= 3.11.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via fusion_button Shortcode
- themefusion Avada (Fusion) Builder
- Cross-site scripting (XSS)