Vendor

    ThemeFusion

    55 known vulnerabilities in products by ThemeFusion, 0 of them actively exploited (CISA KEV).

    Key figures

    55

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    8

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in ThemeFusion
    CriticalCVE-2026-6279

    ThemeFusion Avada (Fusion) Builder: Injection

    		9.8
    CriticalCVE-2026-8713

    Avada (Fusion) Builder <= 3.15.3 - Unauthenticated Arbitrary File Deletion via Form Entry Value

    		9.1
    MediumCVE-2024-2340

    Avada <= 7.11.6 - Unauthenticated Sensitive Information Exposure via Form Uploads Directory Listing

    also in 1 other product

    		5.3
    CriticalCVE-2026-18431

    ThemeFusion Avada (Fusion) Builder: Missing Authorization

    		9.8
    CriticalCVE-2024-13346

    Avada Theme <= 7.11.13 - Unauthenticated Arbitrary Shortcode Execution

    also in 1 other product

    		7.3
    HighCVE-2026-115346

    ThemeFusion Avada | Website Builder For WordPress & WooCommerce: Unrestricted Upload of File with Dangerous Type

    		8.1
    CriticalCVE-2026-97670

    ThemeFusion Avada (Fusion) Builder: Code Injection

    		9.1
    HighCVE-2024-1468

    ThemeFusion Avada | Website Builder For WordPress & WooCommerce: Unrestricted Upload of File with Dangerous Type

    also in 1 other product

    		8.8
    HighCVE-2026-12256

    WordPress Fusion Builder plugin <= 3.15.3 - PHP Object Injection vulnerability

    		8.8
    CriticalCVE-2026-54194

    WordPress Fusion Builder plugin <= 3.15.4 - PHP Object Injection vulnerability

    		9.8
    HighCVE-2026-56008

    WordPress Fusion Builder plugin <= 3.15.4 - Privilege Escalation vulnerability

    		8.8
    HighCVE-2023-39309

    ThemeFusion Fusion Builder: SQL Injection

    		8.5
    HighCVE-2026-4798

    Avada Builder <= 3.15.1 - Unauthenticated SQL Injection via 'product_order' Parameter

    		7.5
    CriticalCVE-2023-39312

    ThemeFusion Avada: Missing Authorization

    also in 1 other product

    		9.1
    HighCVE-2023-39307

    WordPress Avada theme <= 7.11.1 - Authenticated Arbitrary File Upload vulnerability

    also in 1 other product

    		8.5
    HighCVE-2024-2344

    Avada <= 7.11.6 - Authenticated (Admin+) SQL Injection via entry

    also in 1 other product

    		7.2
    HighCVE-2022-41996

    WordPress Avada premium theme <= 7.8.1 - Cross-Site Request Forgery (CSRF) vulnerability

    also in 1 other product

    		8.8
    MediumCVE-2026-4782

    ThemeFusion Avada (Fusion) Builder: Absolute Path Traversal

    		6.5
    HighCVE-2026-54193

    WordPress Fusion Builder plugin <= 3.15.4 - Arbitrary File Deletion vulnerability

    		7.7
    MediumCVE-2026-104729

    ThemeFusion Avada (Fusion) Builder: Cross-site Scripting

    		6.4
    MediumCVE-2026-97340

    ThemeFusion Avada | Website Builder For WordPress & WooCommerce: Cross-site Scripting

    		6.4
    CriticalCVE-2024-13345

    Avada Builder <= 3.11.13 - Unauthenticated Arbitrary Shortcode Execution

    also in 1 other product

    		7.3
    HighCVE-2023-39313

    WordPress Avada theme <= 7.11.1 - Authenticated Server Side Request Forgery (SSRF) vulnerability

    also in 1 other product

    		7.7
    MediumCVE-2026-84925

    ThemeFusion Avada | Website Builder For WordPress & WooCommerce: Cross-site Scripting

    		6.1
    MediumCVE-2026-97471

    ThemeFusion Avada (Fusion) Builder: Exposure of Sensitive Information to an Unauthorized Actor

    		5.3

    All vulnerabilities in search

    Products

    Products by ThemeFusion
    Avada (fusion) Builder190
    Fusion Builder130
    Avada | Website Builder For Wordpress & Woocommerce120
    ThemeFusion Avada80