Login Request a demo
AV
Product
Avada
by Theme-fusion · last CVE Dec 16, 2025
19
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities19In the news0Timeline
Severity mix
Critical 2High 8Medium 9Low 0
Severity
All severities19Critical2High8Medium9Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Avada to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2024-1668
6.5
1%
Mar 13
The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Sensitive Information Exposure in versions up to and including 7.11.5 via the form…
Affected: before 7.11.6
CVE-2024-2343
6.4
1%
Apr 9
The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.11.6 via the…
Affected: before 7.11.7
CVE-2017-18606
6.1
1%
Sep 10
The avada theme before 5.1.5 for WordPress has stored XSS
Affected: before 5.1.5
CVE-2024-5628
5.4
0%
Sep 13
The Avada | Website Builder For WordPress & eCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's fusion_button shortcode in all versions up…
Affected: before 7.11.9
CVE-2024-2311
5.4
1%
Apr 9
The Avada theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 7.11.6 due to insufficient input…
Affected: before 7.11.7
CVE-2020-36711
5.4
1%
Jun 7
The Avada theme for WordPress is vulnerable to Stored Cross-Site Scripting via the update_layout function in versions up to, and including, 6.2.3 due to insufficient input…
Affected: through 6.2.3
CVE-2025-64634
5.3
0%
Dec 16
WordPress Avada theme <= 7.13.2 - Broken Access Control vulnerability
Affected: through 7.13.1
CVE-2024-2340
5.3
28%
Apr 9
The Avada theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.11.6 via the '/wp-content/uploads/fusion-forms/' directory
Affected: before 7.11.7
CVE-2024-54357
4.3
0%
Dec 16
Cross-Site Request Forgery (CSRF) vulnerability in ThemeFusion Avada avada.This issue affects Avada: from n/a through <= 7.11.10
Affected: before 7.11.11
Showing 9