Themefusion vulnerabilities
56 CVEs and advisories name Themefusion as an affected vendor, newest first. Follow it as a feed.
- CVE-2025-49940WordPress Fusion Builder plugin <= 3.13.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2025-6747Avada (Fusion) Builder <= 3.12.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2025-24748WordPress Avada theme <= 7.11.10 - Broken Access Control vulnerability
- CVE-2025-1665Avada Builder <= 3.11.14 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-13345Avada Builder <= 3.11.13 - Unauthenticated Arbitrary Shortcode Execution
- CVE-2024-13346Avada Theme <= 7.11.13 - Unauthenticated Arbitrary Shortcode Execution
- CVE-2024-12477Avada Builder <= 3.11.11 - Authenticated (Contributor+) Stored Cross-Site Scripting in Multiple Widgets
- CVE-2024-12335Avada Builder <= 3.11.12 - Authenticated (Contributor+) Protected Post Disclosure
- CVE-2024-54357WordPress Avada theme <= 7.11.10 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-5628Avada | Website Builder For WordPress & eCommerce <= 3.11.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via fusion_button Shortcode
- CVE-2023-39312WordPress Avada theme <= 7.11.1 - Auth. Unrestricted Zip Extraction vulnerability
- CVE-2023-39310WordPress Avada Builder plugin <= 3.11.1 - Authenticated Broken Access Control vulnerability
- CVE-2023-39922WordPress Avada theme <= 7.11.1 - Authenticated Broken Access Control vulnerability
- CVE-2024-2311Avada <= 7.11.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2024-2344Avada <= 7.11.6 - Authenticated (Admin+) SQL Injection via entry
- CVE-2024-2340Avada <= 7.11.6 - Unauthenticated Sensitive Information Exposure via Form Uploads Directory Listing
- CVE-2024-2343Avada <= 7.11.6 - Authenticated (Contributor+) Server-Side Request Forgery via form_to_url_action
- CVE-2023-39309WordPress Avada Builder plugin <= 3.11.1 - Auth. SQL Injection vulnerability
- CVE-2023-39313WordPress Avada theme <= 7.11.1 - Authenticated Server Side Request Forgery (SSRF) vulnerability
- CVE-2023-39311WordPress Avada Builder plugin <= 3.11.1 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2023-39306WordPress Avada Builder plugin <= 3.11.1 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2023-39307WordPress Avada theme <= 7.11.1 - Authenticated Arbitrary File Upload vulnerability
- CVE-2024-1668Avada <= 7.11.5 - Authenticated(Contributor+) Sensitive Information Exposure via Form Entries
- CVE-2024-1468Avada | Website Builder For WordPress & WooCommerce <= 7.11.4 - Authenticated (Contributor+) Arbitrary File Upload
- CVE-2020-36711Avada <= 6.2.2 - Authenticated (Contributor+) Cross-Site Scripting
- CVE-2022-41996WordPress Avada premium theme <= 7.8.1 - Cross-Site Request Forgery (CSRF) vulnerability