Product by ThemeFusion
Fusion Builder
13 known vulnerabilities in Fusion Builder (ThemeFusion), 0 of them actively exploited (CISA KEV).
Key figures
13
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
1
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-12256 | WordPress Fusion Builder plugin <= 3.15.3 - PHP Object Injection vulnerability | 8.8 | |
| Critical | CVE-2026-54194 | WordPress Fusion Builder plugin <= 3.15.4 - PHP Object Injection vulnerability | 9.8 | |
| High | CVE-2026-56008 | WordPress Fusion Builder plugin <= 3.15.4 - Privilege Escalation vulnerability | 8.8 | |
| High | CVE-2023-39309 | ThemeFusion Fusion Builder: SQL Injection | 8.5 | |
| High | CVE-2026-54193 | WordPress Fusion Builder plugin <= 3.15.4 - Arbitrary File Deletion vulnerability | 7.7 | |
| High | CVE-2026-32542 | WordPress Fusion Builder plugin < 3.15.0 - Reflected Cross Site Scripting (XSS) vulnerability | 7.1 | |
| High | CVE-2023-39306 | WordPress Avada Builder plugin <= 3.11.1 - Reflected Cross Site Scripting (XSS) vulnerability | 7.1 | |
| Medium | CVE-2026-32451 | WordPress Fusion Builder plugin < 3.15.0 - Broken Access Control vulnerability | 6.5 | |
| Medium | CVE-2026-25472 | WordPress Fusion Builder plugin <= 3.14.1 - Cross Site Scripting (XSS) vulnerability | 6.5 | |
| Medium | CVE-2023-39310 | WordPress Avada Builder plugin <= 3.11.1 - Authenticated Broken Access Control vulnerability | 5.4 | |
| Medium | CVE-2025-49940 | WordPress Fusion Builder plugin <= 3.13.2 - Cross Site Scripting (XSS) vulnerability | 6.5 | |
| High | CVE-2023-39311 | WordPress Avada Builder plugin <= 3.11.1 - Cross Site Request Forgery (CSRF) vulnerability | 7.1 | |
| Medium | CVE-2026-32452 | WordPress Fusion Builder plugin < 3.15.0 - Broken Access Control vulnerability | 5.3 |