Skip to content
OpenAdvisories

Vendor

ThemeFusion

56 known vulnerabilities.

Products

Avada (Fusion) Builder 20 Fusion Builder 13 Avada | Website Builder For WordPress & WooCommerce 12 Avada 8 Avada Core 2 Avada (premium WordPress theme) 1 Avada Custom Branding 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-18431 Public exploit

    Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write

    The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16. This is due to a chain of authorization and input val…

    ThemeFusion Avada (Fusion) Builder Avada | Website Builder For WordPress & WooCommerce Web / CMS
  • Critical 9.1
    CVE-2026-8713 Public exploit Scanner template

    Avada (Fusion) Builder <= 3.15.3 - Unauthenticated Arbitrary File Deletion via Form Entry Value

    The Avada (Fusion) Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the maybe_delete_files function in all versions up to, and including, 3.15.3. This makes it possible for unauthenticated attac…

    ThemeFusion Avada (Fusion) Builder Web / CMS
  • Critical 9.8
    CVE-2026-6279 Public exploit Scanner template

    Avada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler

    The Avada Builder (fusion-builder) plugin for WordPress is vulnerable to Unauthenticated Remote Code Execution via PHP Function Injection in versions up to and including 3.15.2. This is due to the `wp_conditional_tags` case in `Fusion_Builder_Conditional_Rend…

    ThemeFusion Avada (Fusion) Builder Web / CMS