Avada | Website Builder For WordPress & WooCommerce vulnerabilities

Product

Avada | Website Builder For WordPress & WooCommerce

by ThemeFusion · last CVE Oct 10, 2026

CVEs

On KEV

9.8

Max CVSS

New 30D

Severity mix

Critical 1High 0Medium 2Low 0

Severity

Exploitation

Watch

Add Avada | Website Builder For WordPress & WooCommerce to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-18431	9.8	1%	Aug 26	Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write Affected: through 7.16
CVE-2026-97340	6.4	0%	Oct 10	Avada \| Website Builder For WordPress & WooCommerce <= 7.16.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'author_facebook' User Profile Field Affected: through 7.16.1
CVE-2026-84925	6.1	0%	Oct 2	Avada \| Website Builder For WordPress & WooCommerce <= 7.16.1 - Reflected Cross-Site Scripting via 'lang' Parameter Affected: through 7.16.1