Skip to content
OpenAdvisories

Vendor

ThemeFusion

56 known vulnerabilities.

Products

Avada (Fusion) Builder 20 Fusion Builder 13 Avada | Website Builder For WordPress & WooCommerce 12 Avada 8 Avada Core 2 Avada (premium WordPress theme) 1 Avada Custom Branding 1
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-97670

    Avada (Fusion) Builder <= 7.16.1 - Unauthenticated Arbitrary WordPress Action Invocation via '{action_hook}' Dynamic-Data Token in Form Field

    The Avada (Fusion) Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16.1. This is due to the plugin not properly verifying authorization before dispatching a WordPress action hook whose name is taken f…

    ThemeFusion Avada (Fusion) Builder Web / CMS
  • Critical 9.8
    CVE-2026-18431 Public exploit

    Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write

    The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16. This is due to a chain of authorization and input val…

    ThemeFusion Avada (Fusion) Builder Avada | Website Builder For WordPress & WooCommerce Web / CMS
  • Critical 9.1
    CVE-2026-8713 Public exploit Scanner template

    Avada (Fusion) Builder <= 3.15.3 - Unauthenticated Arbitrary File Deletion via Form Entry Value

    The Avada (Fusion) Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the maybe_delete_files function in all versions up to, and including, 3.15.3. This makes it possible for unauthenticated attac…

    ThemeFusion Avada (Fusion) Builder Web / CMS
  • Critical 9.8
    CVE-2026-54194

    WordPress Fusion Builder plugin <= 3.15.4 - PHP Object Injection vulnerability

    Contributor PHP Object Injection in Fusion Builder <= 3.15.4 versions.

    ThemeFusion Fusion Builder
  • Critical 9.8
    CVE-2026-6279 Public exploit Scanner template

    Avada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler

    The Avada Builder (fusion-builder) plugin for WordPress is vulnerable to Unauthenticated Remote Code Execution via PHP Function Injection in versions up to and including 3.15.2. This is due to the `wp_conditional_tags` case in `Fusion_Builder_Conditional_Rend…

    ThemeFusion Avada (Fusion) Builder Web / CMS
  • Critical 9.1
    CVE-2023-39312

    WordPress Avada theme <= 7.11.1 - Auth. Unrestricted Zip Extraction vulnerability

    Missing Authorization vulnerability in ThemeFusion Avada.This issue affects Avada: from n/a through 7.11.1.

    ThemeFusion Avada