Login Request a demo
AF
Product
Avada (Fusion) Builder
by themefusion · last CVE Oct 28, 2026
14
CVEs
0
On KEV
9.8
Max CVSS
3
New 30D
Vulnerabilities14In the news0Timeline
Severity mix
Critical 4High 1Medium 9Low 0
Severity
All severities14Critical4High1Medium9Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Avada (Fusion) Builder to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-18431
9.8
1%
Aug 26
Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write
Affected: through 3.16
CVE-2026-6279
9.8
10%
May 21
Avada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler
Affected: through 3.15.2
CVE-2026-97670
9.1
0%
Oct 10
Avada (Fusion) Builder <= 7.16.1 - Unauthenticated Arbitrary WordPress Action Invocation via '{action_hook}' Dynamic-Data Token in Form Field
Affected: through 7.16.1
CVE-2026-8713
9.1
3%
Jun 19
Avada (Fusion) Builder <= 3.15.3 - Unauthenticated Arbitrary File Deletion via Form Entry Value
Affected: through 3.15.3
Showing 4