Avada | Website Builder For WordPress & WooCommerce — Vulnerabilities & Security Advisories 9

All 9 CVE vulnerabilities found in Avada | Website Builder For WordPress & WooCommerce, with AI-generated Chinese analysis, references, and POCs.

Vendor: ThemeFusion

CVE ID	Title	CVSS	Severity	Published
CVE-2026-84925	Avada \| Website Builder For WordPress & WooCommerce <= 7.16.1 - Reflected Cross-Site Scripting via 'lang' Parameter CWE-79	6.1	Medium	2026-10-02
CVE-2024-13346	Avada Theme <= 7.11.13 - Unauthenticated Arbitrary Shortcode Execution CWE-94	7.3	High	2025-02-13
CVE-2024-2311	Avada <= 7.11.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CWE-79	6.4	Medium	2024-04-09
CVE-2024-2344	Avada <= 7.11.6 - Authenticated (Admin+) SQL Injection via entry CWE-89	7.2	High	2024-04-09
CVE-2024-2340	Avada <= 7.11.6 - Unauthenticated Sensitive Information Exposure via Form Uploads Directory Listing CWE-548	5.3	Medium	2024-04-09
CVE-2024-2343	Avada <= 7.11.6 - Authenticated (Contributor+) Server-Side Request Forgery via form_to_url_action CWE-918	6.4	Medium	2024-04-09
CVE-2024-1668	Avada <= 7.11.5 - Authenticated(Contributor+) Sensitive Information Exposure via Form Entries CWE-284	6.5	Medium	2024-03-13
CVE-2024-1468	Avada \| Website Builder For WordPress & WooCommerce <= 7.11.4 - Authenticated (Contributor+) Arbitrary File Upload CWE-434	8.8	High	2024-02-29
CVE-2020-36711	Avada <= 6.2.2 - Authenticated (Contributor+) Cross-Site Scripting CWE-79	6.4	Medium	2023-06-07

All 9 known CVE vulnerabilities affecting Avada | Website Builder For WordPress & WooCommerce with full Chinese analysis, references, and POCs where available.