AF
Product
Avada (Fusion) Builder
12
CVEs
0
On KEV
9.8
Max CVSS
3
New 30D
Severity mix
Critical 4High 1Medium 7Low 0
Watch
Add Avada (Fusion) Builder to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-18431 | 9.8 | Aug 26 | Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write Affected: through 3.16 |
| CVE-2026-6279 | 9.8 | May 21 | Avada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler Affected: through 3.15.2 |
| CVE-2026-97670 | 9.1 | Oct 10 | Avada (Fusion) Builder <= 7.16.1 - Unauthenticated Arbitrary WordPress Action Invocation via '{action_hook}' Dynamic-Data Token in Form Field Affected: through 7.16.1 |
| CVE-2026-8713 | 9.1 | Jun 19 | Avada (Fusion) Builder <= 3.15.3 - Unauthenticated Arbitrary File Deletion via Form Entry Value Affected: through 3.15.3 |
| CVE-2026-4798 | 7.5 | May 13 | Avada Builder <= 3.15.1 - Unauthenticated SQL Injection via 'product_order' Parameter Affected: through 3.15.1 |
| CVE-2026-4782 | 6.5 | May 13 | Avada Builder <= 3.15.2 - Authenticated (Subscriber+) Arbitrary File Read via 'custom_svg' Shortcode Parameter Affected: through 3.15.2 |
| CVE-2026-104729 New | 6.4 | Oct 28 | Avada (Fusion) Builder <= 3.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tab_index' and 'empty_notice' Shortcode Attributes Affected: through 3.16.2 |
| CVE-2026-16654 | 6.4 | Aug 28 | Avada (Fusion) Builder <= 3.15.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' Shortcode Attribute Affected: through 3.15.6 |
| CVE-2026-12536 | 6.4 | Jul 13 | Avada Builder <= 3.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Title Affected: through 3.15.5 |
| CVE-2026-1543 | 6.4 | May 21 | Avada (Fusion) Builder <= 3.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Multiple Shortcodes Affected: through 3.15.2 |
| CVE-2026-97471 | 5.3 | Oct 14 | Avada (Fusion) Builder <= 3.16.1 - Unauthenticated Sensitive Information Exposure in 'args[link_target]' Parameter via {user_meta} Dynamic Data Token Affected: through 3.16.1 |
| CVE-2024-12335 | 4.3 | Dec 25 | Avada Builder <= 3.11.12 - Authenticated (Contributor+) Protected Post Disclosure Affected: through 3.11.12 |
Showing 12