Product by ThemeFusion

    Avada (fusion) Builder

    19 known vulnerabilities in Avada (fusion) Builder (ThemeFusion), 0 of them actively exploited (CISA KEV).

    Key figures

    19

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    5

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Avada (fusion) Builder (ThemeFusion)
    CriticalCVE-2026-6279

    ThemeFusion Avada (Fusion) Builder: Injection

    		9.8
    CriticalCVE-2026-8713

    Avada (Fusion) Builder <= 3.15.3 - Unauthenticated Arbitrary File Deletion via Form Entry Value

    		9.1
    CriticalCVE-2026-18431

    ThemeFusion Avada (Fusion) Builder: Missing Authorization

    also in 1 other product

    		9.8
    CriticalCVE-2026-97670

    ThemeFusion Avada (Fusion) Builder: Code Injection

    		9.1
    HighCVE-2026-4798

    Avada Builder <= 3.15.1 - Unauthenticated SQL Injection via 'product_order' Parameter

    		7.5
    MediumCVE-2026-4782

    ThemeFusion Avada (Fusion) Builder: Absolute Path Traversal

    		6.5
    MediumCVE-2026-104729

    ThemeFusion Avada (Fusion) Builder: Cross-site Scripting

    		6.4
    CriticalCVE-2024-13345

    Avada Builder <= 3.11.13 - Unauthenticated Arbitrary Shortcode Execution

    also in 1 other product

    		7.3
    MediumCVE-2026-97471

    ThemeFusion Avada (Fusion) Builder: Exposure of Sensitive Information to an Unauthorized Actor

    		5.3
    MediumCVE-2026-16654

    ThemeFusion Avada (Fusion) Builder: Cross-site Scripting

    		6.4
    MediumCVE-2026-1543

    ThemeFusion Avada (Fusion) Builder: Cross-site Scripting

    		6.4
    MediumCVE-2026-12536

    Avada Builder <= 3.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Title

    		6.4
    MediumCVE-2026-1509

    ThemeFusion Avada (Fusion) Builder: Code Injection

    		5.4
    MediumCVE-2025-1665

    Avada Builder <= 3.11.14 - Authenticated (Contributor+) Stored Cross-Site Scripting

    also in 1 other product

    		6.4
    MediumCVE-2024-5628

    ThemeFusion Avada (Fusion) Builder: Cross-site Scripting

    also in 1 other product

    		6.4
    MediumCVE-2025-6747

    ThemeFusion Avada (Fusion) Builder: Cross-site Scripting

    		6.4
    MediumCVE-2024-12477

    ThemeFusion Avada (Fusion) Builder: Cross-site Scripting

    also in 1 other product

    		6.4
    MediumCVE-2026-1541

    ThemeFusion Avada (Fusion) Builder: Authorization Bypass Through User-Controlled Key

    		4.3
    MediumCVE-2024-12335

    Avada Builder <= 3.11.12 - Authenticated (Contributor+) Protected Post Disclosure

    also in 1 other product

    		4.3

    All products by ThemeFusion