8.8
High
CVE-2026-12256 Deserialization of Untrusted Data vulnerability in ThemeFusion Fusion Builder fusion-builder allows Object…
Description
Deserialization of Untrusted Data vulnerability in ThemeFusion Fusion Builder fusion-builder allows Object Injection.This issue affects Fusion Builder: from n/a through 3.15.3.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Avada 3.15 | earliest → 3.15.3 | No fix stated |
| Fusion Builder 3.15 | earliest → 3.15.3 | No fix stated |
Other CVEs of Avada
The 9 CVEs of Avada →
CVE-2025-58922
Cross-Site Request Forgery (CSRF) vulnerability in ThemeFusion Avada allows Cross Site Request Forgery.This issue…
4.3
Medium
CVE-2025-64634
Missing Authorization vulnerability in ThemeFusion Avada avada allows Accessing Functionality Not Properly Constrained…
5.3
Medium
CVE-2025-24748
Missing Authorization vulnerability in ThemeFusion Avada avada.This issue affects Avada: from n/a through <= 7.11.10
5.3
Medium
CVE-2024-54357
Cross-Site Request Forgery (CSRF) vulnerability in ThemeFusion Avada avada.This issue affects Avada: from n/a…
4.3
Medium