# cve.now: Themefusion

The newest entries naming Themefusion as an affected vendor (up to 200), of 56 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-84938](https://cve.now/CVE-2026-84938.md): Avada (Fusion) Builder \<= 3.16.1 - Unauthenticated Stored Cross-Site Scripting via Form Notification Dynamic-Data action\_hook (CVSS 7.2)
- [CVE-2026-115346](https://cve.now/CVE-2026-115346.md): Avada | Website Builder For WordPress & WooCommerce \<= 7.16.2 - Unauthenticated Arbitrary File Upload via Avada Form Upload Field (CVSS 8.1)
- [CVE-2026-104729](https://cve.now/CVE-2026-104729.md): Avada (Fusion) Builder \<= 3.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tab\_index' and 'empty\_notice' Shortcode Attributes (CVSS 6.4)
- [CVE-2026-97471](https://cve.now/CVE-2026-97471.md): Avada (Fusion) Builder \<= 3.16.1 - Unauthenticated Sensitive Information Exposure in 'args\[link\_target\]' Parameter via {user\_meta} Dynamic Data Token (CVSS 5.3)
- [CVE-2026-97340](https://cve.now/CVE-2026-97340.md): Avada | Website Builder For WordPress & WooCommerce \<= 7.16.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'author\_facebook' User Profile Field (CVSS 6.4)
- [CVE-2026-97670](https://cve.now/CVE-2026-97670.md): Avada (Fusion) Builder \<= 7.16.1 - Unauthenticated Arbitrary WordPress Action Invocation via '{action\_hook}' Dynamic-Data Token in Form Field (CVSS 9.1)
- [CVE-2026-84925](https://cve.now/CVE-2026-84925.md): Avada | Website Builder For WordPress & WooCommerce \<= 7.16.1 - Reflected Cross-Site Scripting via 'lang' Parameter (CVSS 6.1)
- [CVE-2026-16654](https://cve.now/CVE-2026-16654.md): Avada (Fusion) Builder \<= 3.15.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' Shortcode Attribute (CVSS 6.4)
- [CVE-2026-18431](https://cve.now/CVE-2026-18431.md): Avada \<= 7.16 and Fusion Builder \<= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write (CVSS 9.8)
- [CVE-2026-65524](https://cve.now/CVE-2026-65524.md): WordPress Avada Custom Branding plugin \<= 1.2 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2026-12536](https://cve.now/CVE-2026-12536.md): Avada Builder \<= 3.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Title (CVSS 6.4)
- [CVE-2026-56008](https://cve.now/CVE-2026-56008.md): WordPress Fusion Builder plugin \<= 3.15.4 - Privilege Escalation vulnerability (CVSS 8.8)
- [CVE-2026-8713](https://cve.now/CVE-2026-8713.md): Avada (Fusion) Builder \<= 3.15.3 - Unauthenticated Arbitrary File Deletion via Form Entry Value (CVSS 9.1)
- [CVE-2026-54193](https://cve.now/CVE-2026-54193.md): WordPress Fusion Builder plugin \<= 3.15.4 - Arbitrary File Deletion vulnerability (CVSS 7.7)
- [CVE-2026-12256](https://cve.now/CVE-2026-12256.md): WordPress Fusion Builder plugin \<= 3.15.3 - PHP Object Injection vulnerability (CVSS 8.8)
- [CVE-2026-54194](https://cve.now/CVE-2026-54194.md): WordPress Fusion Builder plugin \<= 3.15.4 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2026-1543](https://cve.now/CVE-2026-1543.md): Avada (Fusion) Builder \<= 3.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Multiple Shortcodes (CVSS 6.4)
- [CVE-2026-6279](https://cve.now/CVE-2026-6279.md): Avada (Fusion) Builder \<= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render\_logics' Shortcode Attribute via Widget AJAX Handler (CVSS 9.8)
- [CVE-2026-4782](https://cve.now/CVE-2026-4782.md): Avada Builder \<= 3.15.2 - Authenticated (Subscriber+) Arbitrary File Read via 'custom\_svg' Shortcode Parameter (CVSS 6.5)
- [CVE-2026-4798](https://cve.now/CVE-2026-4798.md): Avada Builder \<= 3.15.1 - Unauthenticated SQL Injection via 'product\_order' Parameter (CVSS 7.5)
- [CVE-2025-58922](https://cve.now/CVE-2025-58922.md): WordPress Avada theme \< 7.13.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2026-1509](https://cve.now/CVE-2026-1509.md): Avada (Fusion) Builder \<= 3.15.1 - Authenticated (Subscriber+) Limited Arbitrary WordPress Action Execution (CVSS 5.4)
- [CVE-2026-1541](https://cve.now/CVE-2026-1541.md): Avada (Fusion) Builder \<= 3.15.1 - Authenticated (Subscriber+) Sensitive Information Exposure via Insecure Direct Object Reference (CVSS 4.3)
- [CVE-2026-32542](https://cve.now/CVE-2026-32542.md): WordPress Fusion Builder plugin \< 3.15.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-32454](https://cve.now/CVE-2026-32454.md): WordPress Avada Core plugin \< 5.15.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-32453](https://cve.now/CVE-2026-32453.md): WordPress Avada Core plugin \< 5.15.0 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-32452](https://cve.now/CVE-2026-32452.md): WordPress Fusion Builder plugin \< 3.15.0 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-32451](https://cve.now/CVE-2026-32451.md): WordPress Fusion Builder plugin \< 3.15.0 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2026-25472](https://cve.now/CVE-2026-25472.md): WordPress Fusion Builder plugin \<= 3.14.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-64634](https://cve.now/CVE-2025-64634.md): WordPress Avada theme \<= 7.13.2 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2025-49940](https://cve.now/CVE-2025-49940.md): WordPress Fusion Builder plugin \<= 3.13.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-6747](https://cve.now/CVE-2025-6747.md): Avada (Fusion) Builder \<= 3.12.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4)
- [CVE-2025-24748](https://cve.now/CVE-2025-24748.md): WordPress Avada theme \<= 7.11.10 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2025-1665](https://cve.now/CVE-2025-1665.md): Avada Builder \<= 3.11.14 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-13345](https://cve.now/CVE-2024-13345.md): Avada Builder \<= 3.11.13 - Unauthenticated Arbitrary Shortcode Execution (CVSS 7.3)
- [CVE-2024-13346](https://cve.now/CVE-2024-13346.md): Avada Theme \<= 7.11.13 - Unauthenticated Arbitrary Shortcode Execution (CVSS 7.3)
- [CVE-2024-12477](https://cve.now/CVE-2024-12477.md): Avada Builder \<= 3.11.11 - Authenticated (Contributor+) Stored Cross-Site Scripting in Multiple Widgets (CVSS 6.4)
- [CVE-2024-12335](https://cve.now/CVE-2024-12335.md): Avada Builder \<= 3.11.12 - Authenticated (Contributor+) Protected Post Disclosure (CVSS 4.3)
- [CVE-2024-54357](https://cve.now/CVE-2024-54357.md): WordPress Avada theme \<= 7.11.10 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2024-5628](https://cve.now/CVE-2024-5628.md): Avada | Website Builder For WordPress & eCommerce \<= 3.11.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via fusion\_button Shortcode (CVSS 6.4)
- [CVE-2023-39312](https://cve.now/CVE-2023-39312.md): WordPress Avada theme \<= 7.11.1 - Auth. Unrestricted Zip Extraction vulnerability (CVSS 9.1)
- [CVE-2023-39310](https://cve.now/CVE-2023-39310.md): WordPress Avada Builder plugin \<= 3.11.1 - Authenticated Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2023-39922](https://cve.now/CVE-2023-39922.md): WordPress Avada theme \<= 7.11.1 - Authenticated Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2024-2311](https://cve.now/CVE-2024-2311.md): Avada \<= 7.11.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4)
- [CVE-2024-2344](https://cve.now/CVE-2024-2344.md): Avada \<= 7.11.6 - Authenticated (Admin+) SQL Injection via entry (CVSS 7.2)
- [CVE-2024-2340](https://cve.now/CVE-2024-2340.md): Avada \<= 7.11.6 - Unauthenticated Sensitive Information Exposure via Form Uploads Directory Listing (CVSS 5.3)
- [CVE-2024-2343](https://cve.now/CVE-2024-2343.md): Avada \<= 7.11.6 - Authenticated (Contributor+) Server-Side Request Forgery via form\_to\_url\_action (CVSS 6.4)
- [CVE-2023-39309](https://cve.now/CVE-2023-39309.md): WordPress Avada Builder plugin \<= 3.11.1 - Auth. SQL Injection vulnerability (CVSS 8.5)
- [CVE-2023-39313](https://cve.now/CVE-2023-39313.md): WordPress Avada theme \<= 7.11.1 - Authenticated Server Side Request Forgery (SSRF) vulnerability (CVSS 7.7)
- [CVE-2023-39311](https://cve.now/CVE-2023-39311.md): WordPress Avada Builder plugin \<= 3.11.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1)
- [CVE-2023-39306](https://cve.now/CVE-2023-39306.md): WordPress Avada Builder plugin \<= 3.11.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2023-39307](https://cve.now/CVE-2023-39307.md): WordPress Avada theme \<= 7.11.1 - Authenticated Arbitrary File Upload vulnerability (CVSS 8.5)
- [CVE-2024-1668](https://cve.now/CVE-2024-1668.md): Avada \<= 7.11.5 - Authenticated(Contributor+) Sensitive Information Exposure via Form Entries (CVSS 6.5)
- [CVE-2024-1468](https://cve.now/CVE-2024-1468.md): Avada | Website Builder For WordPress & WooCommerce \<= 7.11.4 - Authenticated (Contributor+) Arbitrary File Upload (CVSS 8.8)
- [CVE-2020-36711](https://cve.now/CVE-2020-36711.md): Avada \<= 6.2.2 - Authenticated (Contributor+) Cross-Site Scripting (CVSS 6.4)
- [CVE-2022-41996](https://cve.now/CVE-2022-41996.md): WordPress Avada premium theme \<= 7.8.1 - Cross-Site Request Forgery (CSRF) vulnerability (CVSS 8.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/themefusion
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.