Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Avada (Fusion) Builder — Vulnerabilities & Security Advisories 16

All 16 CVE vulnerabilities found in Avada (Fusion) Builder, with AI-generated Chinese analysis, references, and POCs.

This page aggregates known security vulnerabilities affecting the Avada (Fusion) Builder plugin for WordPress. It collects a comprehensive inventory of reported flaws, covering historical and recent advisories issued by the developer and third-party security researchers. Here, you can track the vendor's response patterns, analyze the specific weakness classes such as cross-site scripting or privilege escalation, and review the complete vulnerability history for this product. The content focuses on technical details, impact assessments, and fix status, providing a structured view of the security posture of this specific WordPress extension.

Vendor: themefusion

CVE ID Title CVSS Severity Published
CVE-2026-16654 Avada (Fusion) Builder <= 3.15.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' Shortcode Attribute CWE-79 6.4 Medium 2026-08-28
CVE-2026-18431 Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write CWE-862 9.8 Critical 2026-08-26
CVE-2026-12536 Avada Builder <= 3.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Title CWE-79 6.4 Medium 2026-07-13
CVE-2026-8713 Avada (Fusion) Builder <= 3.15.3 - Unauthenticated Arbitrary File Deletion via Form Entry Value CWE-22 9.1 Critical 2026-06-19
CVE-2026-1543 Avada (Fusion) Builder <= 3.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Multiple Shortcodes CWE-79 6.4 Medium 2026-05-21
CVE-2026-6279 Avada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler CWE-74 9.8 Critical 2026-05-21
CVE-2026-4782 Avada Builder <= 3.15.2 - Authenticated (Subscriber+) Arbitrary File Read via 'custom_svg' Shortcode Parameter CWE-36 6.5 Medium 2026-05-13
CVE-2026-4798 Avada Builder <= 3.15.1 - Unauthenticated SQL Injection via 'product_order' Parameter CWE-89 7.5 High 2026-05-13
CVE-2026-1541 Avada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Sensitive Information Exposure via Insecure Direct Object Reference CWE-639 4.3 Medium 2026-04-15
CVE-2026-1509 Avada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Limited Arbitrary WordPress Action Execution CWE-94 5.4 Medium 2026-04-15
CVE-2025-6747 Avada (Fusion) Builder <= 3.12.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CWE-79 6.4 Medium 2025-07-16
CVE-2025-1665 Avada Builder <= 3.11.14 - Authenticated (Contributor+) Stored Cross-Site Scripting CWE-79 6.4 Medium 2025-04-01
CVE-2024-13345 Avada Builder <= 3.11.13 - Unauthenticated Arbitrary Shortcode Execution CWE-94 7.3 High 2025-02-13
CVE-2024-12477 Avada Builder <= 3.11.11 - Authenticated (Contributor+) Stored Cross-Site Scripting in Multiple Widgets CWE-79 6.4 Medium 2025-01-22
CVE-2024-12335 Avada Builder <= 3.11.12 - Authenticated (Contributor+) Protected Post Disclosure CWE-639 4.3 Medium 2024-12-25
CVE-2024-5628 Avada | Website Builder For WordPress & eCommerce <= 3.11.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via fusion_button Shortcode CWE-79 6.4 Medium 2024-09-13

All 16 known CVE vulnerabilities affecting Avada (Fusion) Builder with full Chinese analysis, references, and POCs where available.