Advisories · Technology

ThemeFusion Avada.

Every CVE that names ThemeFusion Avada among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2025-58922 CVE record

CVSS 4.3 Medium

WordPress Avada theme < 7.13.2 - Cross Site Request Forgery (CSRF) vulnerability
- ThemeFusion Avada
- Cross-site request forgery (CSRF)
Not analysed yet 22 Apr 2026
CVE-2025-64634 CVE record

CVSS 5.3 Medium

WordPress Avada theme <= 7.13.2 - Broken Access Control vulnerability
- ThemeFusion Avada
- Broken access control
Not analysed yet 16 Dec 2025
CVE-2025-24748 CVE record

CVSS 5.3 Medium

WordPress Avada theme <= 7.11.10 - Broken Access Control vulnerability
- ThemeFusion Avada
- Broken access control
Not analysed yet 4 Jul 2025
CVE-2024-54357 CVE record

CVSS 4.3 Medium

WordPress Avada theme <= 7.11.10 - Cross Site Request Forgery (CSRF) vulnerability
- ThemeFusion Avada
- Cross-site request forgery (CSRF)
Not analysed yet 16 Dec 2024
CVE-2023-39312 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

WordPress Avada theme <= 7.11.1 - Auth. Unrestricted Zip Extraction vulnerability
- ThemeFusion Avada
- Broken access control
Not analysed yet 19 Jun 2024
CVE-2023-39922 CVE record

CVSS 4.3 Medium

WordPress Avada theme <= 7.11.1 - Authenticated Broken Access Control vulnerability
- ThemeFusion Avada
- Broken access control
Not analysed yet 19 Jun 2024
CVE-2023-39313 CVE record

CVSS 7.7 High

WordPress Avada theme <= 7.11.1 - Authenticated Server Side Request Forgery (SSRF) vulnerability
- ThemeFusion Avada
- Server-side request forgery (SSRF)
Not analysed yet 28 Mar 2024
CVE-2023-39307 CVE record

CVSS 8.5 High

WordPress Avada theme <= 7.11.1 - Authenticated Arbitrary File Upload vulnerability
- ThemeFusion Avada
- Unrestricted file upload
Not analysed yet 26 Mar 2024