themefusion

Top products

The 15 most recently published vulnerabilities affecting themefusion.

• CVE-2026-65524WordPress Avada Custom Branding plugin <= 1.2 - Broken Access Control vulnerability4.3Jul 23, 2026
• CVE-2026-12536Avada Builder <= 3.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Title6.4Jul 13, 2026
• CVE-2026-56008WordPress Fusion Builder plugin <= 3.15.4 - Privilege Escalation vulnerability8.8Jun 26, 2026
• CVE-2026-8713Avada (Fusion) Builder <= 3.15.3 - Unauthenticated Arbitrary File Deletion via Form Entry Value9.1Jun 19, 2026
• CVE-2026-54193WordPress Fusion Builder plugin <= 3.15.4 - Arbitrary File Deletion vulnerability7.7Jun 17, 2026
• CVE-2026-12256WordPress Avada theme <= 3.15.3 - PHP Object Injection vulnerability8.8Jun 16, 2026
• CVE-2026-54194WordPress Fusion Builder plugin <= 3.15.4 - PHP Object Injection vulnerability9.8Jun 16, 2026
• CVE-2026-1543Avada (Fusion) Builder <= 3.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Multiple Shortcodes6.4May 21, 2026
• CVE-2026-6279Avada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler9.8May 21, 2026
• CVE-2026-4782Avada Builder <= 3.15.2 - Authenticated (Subscriber+) Arbitrary File Read via 'custom_svg' Shortcode Parameter6.5May 13, 2026
• CVE-2026-4798Avada Builder <= 3.15.1 - Unauthenticated SQL Injection via 'product_order' Parameter7.5May 13, 2026
• CVE-2025-58922WordPress Avada theme < 7.13.2 - Cross Site Request Forgery (CSRF) vulnerability4.3Apr 22, 2026
• CVE-2026-1509Avada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Limited Arbitrary WordPress Action Execution5.4Apr 15, 2026
• CVE-2026-1541Avada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Sensitive Information Exposure via Insecure Direct Object Reference4.3Apr 15, 2026
• CVE-2026-32542WordPress Fusion Builder plugin < 3.15.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1Mar 25, 2026