agentprime: themefusion-avada-fusion-builderEvery new CVE for themefusion-avada-fusion-builder.https://agentprime.io/CVE-2026-104729: Avada (Fusion) Builder <= 3.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tab_index' and 'empty_notice' Shortcode Attributeshttps://agentprime.io/advisories/CVE-2026-104729/https://agentprime.io/advisories/CVE-2026-104729/CVSS 6.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 28 Oct 2026 06:45:13 GMTCVECVE-2026-97471: Avada (Fusion) Builder <= 3.16.1 - Unauthenticated Sensitive Information Exposure in 'args[link_target]' Parameter via {user_meta} Dynamic Data Tokenhttps://agentprime.io/advisories/CVE-2026-97471/https://agentprime.io/advisories/CVE-2026-97471/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 14 Oct 2026 03:40:06 GMTCVECVE-2026-97670: Avada (Fusion) Builder <= 7.16.1 - Unauthenticated Arbitrary WordPress Action Invocation via '{action_hook}' Dynamic-Data Token in Form Fieldhttps://agentprime.io/advisories/CVE-2026-97670/https://agentprime.io/advisories/CVE-2026-97670/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Sat, 10 Oct 2026 04:26:48 GMTCVEcriticalCVE-2026-16654: Avada (Fusion) Builder <= 3.15.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' Shortcode Attributehttps://agentprime.io/advisories/CVE-2026-16654/https://agentprime.io/advisories/CVE-2026-16654/CVSS 6.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 28 Aug 2026 04:28:23 GMTCVECVE-2026-18431: Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Writehttps://agentprime.io/advisories/CVE-2026-18431/https://agentprime.io/advisories/CVE-2026-18431/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 26 Aug 2026 06:08:28 GMTCVEcriticalCVE-2026-12536: Avada Builder <= 3.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Titlehttps://agentprime.io/advisories/CVE-2026-12536/https://agentprime.io/advisories/CVE-2026-12536/CVSS 6.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 13 Jul 2026 19:33:56 GMTCVECVE-2026-8713: Avada (Fusion) Builder <= 3.15.3 - Unauthenticated Arbitrary File Deletion via Form Entry Valuehttps://agentprime.io/advisories/CVE-2026-8713/https://agentprime.io/advisories/CVE-2026-8713/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 19 Jun 2026 04:31:34 GMTCVEcriticalCVE-2026-1543: Avada (Fusion) Builder <= 3.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Multiple Shortcodeshttps://agentprime.io/advisories/CVE-2026-1543/https://agentprime.io/advisories/CVE-2026-1543/CVSS 6.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 21 May 2026 04:28:02 GMTCVECVE-2026-6279: Avada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handlerhttps://agentprime.io/advisories/CVE-2026-6279/https://agentprime.io/advisories/CVE-2026-6279/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 21 May 2026 04:27:57 GMTCVEcriticalCVE-2026-4782: Avada Builder <= 3.15.2 - Authenticated (Subscriber+) Arbitrary File Read via 'custom_svg' Shortcode Parameterhttps://agentprime.io/advisories/CVE-2026-4782/https://agentprime.io/advisories/CVE-2026-4782/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 13 May 2026 09:26:13 GMTCVECVE-2026-4798: Avada Builder <= 3.15.1 - Unauthenticated SQL Injection via 'product_order' Parameterhttps://agentprime.io/advisories/CVE-2026-4798/https://agentprime.io/advisories/CVE-2026-4798/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 13 May 2026 09:26:12 GMTCVECVE-2026-1509: Avada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Limited Arbitrary WordPress Action Executionhttps://agentprime.io/advisories/CVE-2026-1509/https://agentprime.io/advisories/CVE-2026-1509/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 15 Apr 2026 01:25:18 GMTCVECVE-2026-1541: Avada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Sensitive Information Exposure via Insecure Direct Object Referencehttps://agentprime.io/advisories/CVE-2026-1541/https://agentprime.io/advisories/CVE-2026-1541/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 15 Apr 2026 01:25:17 GMTCVECVE-2025-6747: Avada (Fusion) Builder <= 3.12.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodehttps://agentprime.io/advisories/CVE-2025-6747/https://agentprime.io/advisories/CVE-2025-6747/CVSS 6.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 16 Jul 2025 06:40:43 GMTCVECVE-2025-1665: Avada Builder <= 3.11.14 - Authenticated (Contributor+) Stored Cross-Site Scriptinghttps://agentprime.io/advisories/CVE-2025-1665/https://agentprime.io/advisories/CVE-2025-1665/CVSS 6.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 01 Apr 2025 05:22:46 GMTCVECVE-2024-13345: Avada Builder <= 3.11.13 - Unauthenticated Arbitrary Shortcode Executionhttps://agentprime.io/advisories/CVE-2024-13345/https://agentprime.io/advisories/CVE-2024-13345/CVSS 7.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 13 Feb 2025 06:58:05 GMTCVECVE-2024-12477: Avada Builder <= 3.11.11 - Authenticated (Contributor+) Stored Cross-Site Scripting in Multiple Widgetshttps://agentprime.io/advisories/CVE-2024-12477/https://agentprime.io/advisories/CVE-2024-12477/CVSS 6.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 22 Jan 2025 21:21:53 GMTCVECVE-2024-12335: Avada Builder <= 3.11.12 - Authenticated (Contributor+) Protected Post Disclosurehttps://agentprime.io/advisories/CVE-2024-12335/https://agentprime.io/advisories/CVE-2024-12335/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 25 Dec 2024 06:42:13 GMTCVECVE-2024-5628: Avada | Website Builder For WordPress & eCommerce <= 3.11.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via fusion_button Shortcodehttps://agentprime.io/advisories/CVE-2024-5628/https://agentprime.io/advisories/CVE-2024-5628/CVSS 6.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 13 Sep 2024 05:30:55 GMTCVE