Advisories · Technology
ThemeFusion Avada | Website Builder For WordPress & WooCommerce.
Every CVE that names ThemeFusion Avada | Website Builder For WordPress & WooCommerce among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.1 High
Avada | Website Builder For WordPress & WooCommerce <= 7.16.2 - Unauthenticated Arbitrary File Upload via Avada Form Upload Field
- ThemeFusion Avada | Website Builder For WordPress & WooCommerce
- Unrestricted file upload
- CVSS 6.4 Medium
Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'author_facebook' User Profile Field
- ThemeFusion Avada | Website Builder For WordPress & WooCommerce
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Reflected Cross-Site Scripting via 'lang' Parameter
- ThemeFusion Avada | Website Builder For WordPress & WooCommerce
- Cross-site scripting (XSS)
- CVSS 9.8 CriticalCritical · CVSS 9+
Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write
- themefusion Avada (Fusion) Builder
- ThemeFusion Avada | Website Builder For WordPress & WooCommerce
- Broken access control
- CVSS 7.3 High
Avada Theme <= 7.11.13 - Unauthenticated Arbitrary Shortcode Execution
- ThemeFusion Avada | Website Builder For WordPress & WooCommerce
- Code injection
- CVSS 6.4 Medium
Avada <= 7.11.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- ThemeFusion Avada | Website Builder For WordPress & WooCommerce
- Cross-site scripting (XSS)
- CVSS 7.2 High
Avada <= 7.11.6 - Authenticated (Admin+) SQL Injection via entry
- ThemeFusion Avada | Website Builder For WordPress & WooCommerce
- SQL injection
- CVSS 5.3 Medium
Avada <= 7.11.6 - Unauthenticated Sensitive Information Exposure via Form Uploads Directory Listing
- ThemeFusion Avada | Website Builder For WordPress & WooCommerce
- CWE-548
- CVSS 6.4 Medium
Avada <= 7.11.6 - Authenticated (Contributor+) Server-Side Request Forgery via form_to_url_action
- ThemeFusion Avada | Website Builder For WordPress & WooCommerce
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
Avada <= 7.11.5 - Authenticated(Contributor+) Sensitive Information Exposure via Form Entries
- ThemeFusion Avada | Website Builder For WordPress & WooCommerce
- Broken access control
- CVSS 8.8 High
Avada | Website Builder For WordPress & WooCommerce <= 7.11.4 - Authenticated (Contributor+) Arbitrary File Upload
- ThemeFusion Avada | Website Builder For WordPress & WooCommerce
- Unrestricted file upload
- CVSS 6.4 Medium
Avada <= 6.2.2 - Authenticated (Contributor+) Cross-Site Scripting
- ThemeFusion Avada | Website Builder For WordPress & WooCommerce
- Cross-site scripting (XSS)