Themefusion vulnerabilities
56 CVEs and advisories name Themefusion as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-84938Avada (Fusion) Builder <= 3.16.1 - Unauthenticated Stored Cross-Site Scripting via Form Notification Dynamic-Data action_hook
- CVE-2026-115346Avada | Website Builder For WordPress & WooCommerce <= 7.16.2 - Unauthenticated Arbitrary File Upload via Avada Form Upload Field
- CVE-2026-104729Avada (Fusion) Builder <= 3.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tab_index' and 'empty_notice' Shortcode Attributes
- CVE-2026-97471Avada (Fusion) Builder <= 3.16.1 - Unauthenticated Sensitive Information Exposure in 'args[link_target]' Parameter via {user_meta} Dynamic Data Token
- CVE-2026-97340Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'author_facebook' User Profile Field
- CVE-2026-97670Avada (Fusion) Builder <= 7.16.1 - Unauthenticated Arbitrary WordPress Action Invocation via '{action_hook}' Dynamic-Data Token in Form Field
- CVE-2026-84925Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Reflected Cross-Site Scripting via 'lang' Parameter
- CVE-2026-16654Avada (Fusion) Builder <= 3.15.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' Shortcode Attribute
- CVE-2026-18431Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write
- CVE-2026-65524WordPress Avada Custom Branding plugin <= 1.2 - Broken Access Control vulnerability
- CVE-2026-12536Avada Builder <= 3.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Title
- CVE-2026-56008WordPress Fusion Builder plugin <= 3.15.4 - Privilege Escalation vulnerability
- CVE-2026-8713Avada (Fusion) Builder <= 3.15.3 - Unauthenticated Arbitrary File Deletion via Form Entry Value
- CVE-2026-54193WordPress Fusion Builder plugin <= 3.15.4 - Arbitrary File Deletion vulnerability
- CVE-2026-12256WordPress Fusion Builder plugin <= 3.15.3 - PHP Object Injection vulnerability
- CVE-2026-54194WordPress Fusion Builder plugin <= 3.15.4 - PHP Object Injection vulnerability
- CVE-2026-1543Avada (Fusion) Builder <= 3.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Multiple Shortcodes
- CVE-2026-6279Avada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler
- CVE-2026-4782Avada Builder <= 3.15.2 - Authenticated (Subscriber+) Arbitrary File Read via 'custom_svg' Shortcode Parameter
- CVE-2026-4798Avada Builder <= 3.15.1 - Unauthenticated SQL Injection via 'product_order' Parameter
- CVE-2025-58922WordPress Avada theme < 7.13.2 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-1509Avada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Limited Arbitrary WordPress Action Execution
- CVE-2026-1541Avada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Sensitive Information Exposure via Insecure Direct Object Reference
- CVE-2026-32542WordPress Fusion Builder plugin < 3.15.0 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-32454WordPress Avada Core plugin < 5.15.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-32453WordPress Avada Core plugin < 5.15.0 - Broken Access Control vulnerability
- CVE-2026-32452WordPress Fusion Builder plugin < 3.15.0 - Broken Access Control vulnerability
- CVE-2026-32451WordPress Fusion Builder plugin < 3.15.0 - Broken Access Control vulnerability
- CVE-2026-25472WordPress Fusion Builder plugin <= 3.14.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2025-64634WordPress Avada theme <= 7.13.2 - Broken Access Control vulnerability