Product by ThemeFusion
Avada | Website Builder For Wordpress & Woocommerce
12 known vulnerabilities in Avada | Website Builder For Wordpress & Woocommerce (ThemeFusion), 0 of them actively exploited (CISA KEV).
Key figures
12
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
2
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Medium | CVE-2024-2340 | Avada <= 7.11.6 - Unauthenticated Sensitive Information Exposure via Form Uploads Directory Listing | 5.3 | |
| Critical | CVE-2026-18431 | ThemeFusion Avada (Fusion) Builder: Missing Authorization | 9.8 | |
| Critical | CVE-2024-13346 | Avada Theme <= 7.11.13 - Unauthenticated Arbitrary Shortcode Execution | 7.3 | |
| High | CVE-2026-115346 | ThemeFusion Avada | Website Builder For WordPress & WooCommerce: Unrestricted Upload of File with Dangerous Type | 8.1 | |
| High | CVE-2024-1468 | ThemeFusion Avada | Website Builder For WordPress & WooCommerce: Unrestricted Upload of File with Dangerous Type | 8.8 | |
| High | CVE-2024-2344 | Avada <= 7.11.6 - Authenticated (Admin+) SQL Injection via entry | 7.2 | |
| Medium | CVE-2026-97340 | ThemeFusion Avada | Website Builder For WordPress & WooCommerce: Cross-site Scripting | 6.4 | |
| Medium | CVE-2026-84925 | ThemeFusion Avada | Website Builder For WordPress & WooCommerce: Cross-site Scripting | 6.1 | |
| Medium | CVE-2024-2311 | Avada <= 7.11.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode | 6.4 | |
| Medium | CVE-2024-1668 | Avada <= 7.11.5 - Authenticated (Contributor+) Sensitive Information Exposure via Form Entries | 6.5 | |
| Medium | CVE-2020-36711 | Avada <= 6.2.2 - Authenticated (Contributor+) Cross-Site Scripting | 6.4 | |
| Medium | CVE-2024-2343 | Avada <= 7.11.6 - Authenticated (Contributor+) Server-Side Request Forgery via form_to_url_action | 6.4 |