| CVE-2026-84938 |
Avada (Fusion) Builder <= 3.16.1 - Unauthenticated Stored Cross-Site Scripting via Form Notification Dynamic-Data action_hook
|
7.2
High
|
Nov 10, 2026 |
| CVE-2026-104729 |
The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tab_index,…
|
6.4
Medium
|
Oct 28, 2026 |
| CVE-2026-97471 |
The Avada (Fusion) Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to,…
|
5.3
Medium
|
Oct 14, 2026 |
| CVE-2026-97670 |
The Avada (Fusion) Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and…
|
9.1
Critical
|
Oct 10, 2026 |
| CVE-2026-16654 |
The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'size' Shortcode…
|
6.4
Medium
|
Aug 28, 2026 |
| CVE-2026-18431 |
The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when…
|
9.8
Critical
|
Aug 26, 2026 |
| CVE-2026-12536 |
The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Module Title’…
|
6.4
Medium
|
Jul 13, 2026 |
| CVE-2026-8713 |
The Avada (Fusion) Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path…
|
9.1
Critical
|
Jun 19, 2026 |
| CVE-2026-1543 |
The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcodes…
|
6.4
Medium
|
May 21, 2026 |
| CVE-2026-6279 |
The Avada Builder (fusion-builder) plugin for WordPress is vulnerable to Unauthenticated Remote Code Execution via PHP…
|
9.8
Critical
|
May 21, 2026 |
| CVE-2026-4782 |
The Avada Builder plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.15.2…
|
6.5
Medium
|
May 13, 2026 |
| CVE-2026-4798 |
The Avada Builder plugin for WordPress is vulnerable to time-based SQL Injection via the ‘product_order’ parameter in…
|
7.5
High
|
May 13, 2026 |
| CVE-2026-1509 |
The Avada (Fusion) Builder plugin for WordPress is vulnerable to Arbitrary WordPress Action Execution in all versions up…
|
5.4
Medium
|
Apr 15, 2026 |
| CVE-2026-1541 |
The Avada (Fusion) Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to,…
|
4.3
Medium
|
Apr 15, 2026 |
| CVE-2025-6747 |
The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's…
|
6.4
Medium
|
Jul 16, 2025 |
| CVE-2025-1665 |
The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of the plugin's…
|
6.4
Medium
|
Apr 1, 2025 |
| CVE-2024-13345 |
The Avada Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and…
|
7.3
High
|
Feb 13, 2025 |
| CVE-2024-12477 |
The Avada Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all…
|
6.4
Medium
|
Jan 22, 2025 |
| CVE-2024-12335 |
The Avada (Fusion) Builder plugin for WordPress is vulnerable to Information Exposure in all versions up to, and…
|
4.3
Medium
|
Dec 25, 2024 |
| CVE-2024-5628 |
The Avada | Website Builder For WordPress & eCommerce plugin for WordPress is vulnerable to Stored Cross-Site…
|
6.4
Medium
|
Sep 13, 2024 |