Product by ThemeFusion

    ThemeFusion Avada | Website Builder For WordPress & WooCommerce

    19 known vulnerabilities in ThemeFusion Avada | Website Builder For WordPress & WooCommerce (ThemeFusion), 0 of them actively exploited (CISA KEV).

    Key figures

    19

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    3

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in ThemeFusion Avada | Website Builder For WordPress & WooCommerce (ThemeFusion)
    CriticalCVE-2022-1386

    Fusion Builder < 3.6.2 - Unauthenticated SSRF

    		9.8
    MediumCVE-2024-2340

    Avada <= 7.11.6 - Unauthenticated Sensitive Information Exposure via Form Uploads Directory Listing

    also in 1 other product

    		5.3
    CriticalCVE-2024-13346

    Avada Theme <= 7.11.13 - Unauthenticated Arbitrary Shortcode Execution

    also in 1 other product

    		7.3
    HighCVE-2024-1468

    ThemeFusion Avada | Website Builder For WordPress & WooCommerce: Unrestricted Upload of File with Dangerous Type

    also in 1 other product

    		8.8
    CriticalCVE-2023-39312

    ThemeFusion Avada: Missing Authorization

    also in 1 other product

    		9.1
    HighCVE-2023-39307

    WordPress Avada theme <= 7.11.1 - Authenticated Arbitrary File Upload vulnerability

    also in 1 other product

    		8.5
    HighCVE-2024-2344

    Avada <= 7.11.6 - Authenticated (Admin+) SQL Injection via entry

    also in 1 other product

    		7.2
    HighCVE-2017-18607

    Theme-fusion Avada: Cross-Site Request Forgery (CSRF)

    		8.8
    HighCVE-2022-41996

    WordPress Avada premium theme <= 7.8.1 - Cross-Site Request Forgery (CSRF) vulnerability

    also in 1 other product

    		8.8
    HighCVE-2023-39313

    WordPress Avada theme <= 7.11.1 - Authenticated Server Side Request Forgery (SSRF) vulnerability

    also in 1 other product

    		7.7
    MediumCVE-2017-18606

    Theme-fusion Avada: Cross-Site Scripting (XSS)

    		6.1
    MediumCVE-2024-2311

    Avada <= 7.11.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    also in 1 other product

    		6.4
    MediumCVE-2024-1668

    Avada <= 7.11.5 - Authenticated (Contributor+) Sensitive Information Exposure via Form Entries

    also in 1 other product

    		6.5
    MediumCVE-2020-36711

    Avada <= 6.2.2 - Authenticated (Contributor+) Cross-Site Scripting

    also in 1 other product

    		6.4
    MediumCVE-2024-2343

    Avada <= 7.11.6 - Authenticated (Contributor+) Server-Side Request Forgery via form_to_url_action

    also in 1 other product

    		6.4
    MediumCVE-2024-5628

    ThemeFusion Avada (Fusion) Builder: Cross-site Scripting

    also in 1 other product

    		6.4
    MediumCVE-2025-64634

    WordPress Avada theme <= 7.13.2 - Broken Access Control vulnerability

    also in 1 other product

    		5.3
    HighCVE-2023-39922

    WordPress Avada theme <= 7.11.1 - Authenticated Broken Access Control vulnerability

    also in 1 other product

    		4.3
    MediumCVE-2024-54357

    WordPress Avada theme <= 7.11.10 - Cross Site Request Forgery (CSRF) vulnerability

    also in 1 other product

    		4.3

    All products by ThemeFusion