ThemeFusion vulnerabilities

CVEs per yearBy the year they were published

1. 20221
2. 20231
3. 202417
4. 20258
5. 202628

Newest CVEs

• CVE-2026-115346

  Avada | Website Builder For WordPress & WooCommerce <= 7.16.2 - Unauthenticated Arbitrary File Upload via Avada Form Upload Field

  ThemeFusion · Avada | Website Builder For WordPress & WooCommerce

  High8.1
• CVE-2026-104729

  Avada (Fusion) Builder <= 3.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tab_index' and 'empty_notice' Shortcode Attributes

  themefusion · Avada (Fusion) Builder

  Medium6.4
• CVE-2026-97471

  Avada (Fusion) Builder <= 3.16.1 - Unauthenticated Sensitive Information Exposure in 'args[link_target]' Parameter via {user_meta} Dynamic Data Token

  themefusion · Avada (Fusion) Builder

  Medium5.3
• CVE-2026-97340

  Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'author_facebook' User Profile Field

  ThemeFusion · Avada | Website Builder For WordPress & WooCommerce

  Medium6.4
• CVE-2026-97670

  Avada (Fusion) Builder <= 7.16.1 - Unauthenticated Arbitrary WordPress Action Invocation via '{action_hook}' Dynamic-Data Token in Form Field

  themefusion · Avada (Fusion) Builder

  Critical9.1
• CVE-2026-84925

  Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Reflected Cross-Site Scripting via 'lang' Parameter

  ThemeFusion · Avada | Website Builder For WordPress & WooCommerce

  Medium6.1
• CVE-2026-16654

  Avada (Fusion) Builder <= 3.15.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' Shortcode Attribute

  themefusion · Avada (Fusion) Builder

  Medium6.4
• CVE-2026-18431

  Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write

  themefusion · Avada (Fusion) Builder

  Critical9.8
• CVE-2026-65524

  WordPress Avada Custom Branding plugin <= 1.2 - Broken Access Control vulnerability

  ThemeFusion · Avada Custom Branding

  Medium4.3
• CVE-2026-12536

  Avada Builder <= 3.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Title

  themefusion · Avada (Fusion) Builder

  Medium6.4