AF
Product
Avada (Fusion) Builder
14
CVEs
0
On KEV
9.8
Max CVSS
3
New 30D
Severity mix
Critical 4High 1Medium 9Low 0
Watch
Add Avada (Fusion) Builder to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-4782 | 6.5 | May 13 | Avada Builder <= 3.15.2 - Authenticated (Subscriber+) Arbitrary File Read via 'custom_svg' Shortcode Parameter Affected: through 3.15.2 |
| CVE-2026-104729 New | 6.4 | Oct 28 | Avada (Fusion) Builder <= 3.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tab_index' and 'empty_notice' Shortcode Attributes Affected: through 3.16.2 |
| CVE-2026-16654 | 6.4 | Aug 28 | Avada (Fusion) Builder <= 3.15.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' Shortcode Attribute Affected: through 3.15.6 |
| CVE-2026-12536 | 6.4 | Jul 13 | Avada Builder <= 3.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Title Affected: through 3.15.5 |
| CVE-2026-1543 | 6.4 | May 21 | Avada (Fusion) Builder <= 3.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Multiple Shortcodes Affected: through 3.15.2 |
| CVE-2026-1509 | 5.4 | Apr 15 | Avada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Limited Arbitrary WordPress Action Execution Affected: through 3.15.1 |
| CVE-2026-97471 | 5.3 | Oct 14 | Avada (Fusion) Builder <= 3.16.1 - Unauthenticated Sensitive Information Exposure in 'args[link_target]' Parameter via {user_meta} Dynamic Data Token Affected: through 3.16.1 |
| CVE-2026-1541 | 4.3 | Apr 15 | Avada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Sensitive Information Exposure via Insecure Direct Object Reference Affected: through 3.15.1 |
| CVE-2024-12335 | 4.3 | Dec 25 | Avada Builder <= 3.11.12 - Authenticated (Contributor+) Protected Post Disclosure Affected: through 3.11.12 |
Showing 9