TH
Vendor
Theme-fusion
23
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2025-64634 | AV Avada Theme-fusion | 5.3 | Dec 16 | Missing Authorization vulnerability in ThemeFusion Avada avada allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Avada: from n/a through <= 7.13.2 |
| CVE-2025-1665 | AB Avada Builder Theme-fusion | 5.4 | Apr 1 | The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of the plugin's shortcodes in all versions up to, and including, 3.11.14… |
| CVE-2024-13346 | AV Avada Theme-fusion | 9.8 | Feb 13 | The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 7.11.13 |
| CVE-2024-13345 | AB Avada Builder Theme-fusion | 9.8 | Feb 13 | The Avada Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.11.13 |
| CVE-2024-12477 | AB Avada Builder Theme-fusion | 5.4 | Jan 22 | The Avada Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 3.11.11 due to insufficient… |
| CVE-2024-12335 | AB Avada Builder Theme-fusion | 4.3 | Dec 25 | Avada Builder <= 3.11.12 - Authenticated (Contributor+) Protected Post Disclosure |
| CVE-2024-54357 | AV Avada Theme-fusion | 4.3 | Dec 16 | Cross-Site Request Forgery (CSRF) vulnerability in ThemeFusion Avada avada.This issue affects Avada: from n/a through <= 7.11.10 |
| CVE-2024-5628 | AV Avada Theme-fusion | 5.4 | Sep 13 | The Avada | Website Builder For WordPress & eCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's fusion_button shortcode in all versions up… |
| CVE-2023-39312 | AV Avada Theme-fusion | 8.8 | Jun 19 | Missing Authorization vulnerability in ThemeFusion Avada.This issue affects Avada: from n/a through 7.11.1 |
| CVE-2023-39922 | AV Avada Theme-fusion | 8.8 | Jun 19 | Missing Authorization vulnerability in ThemeFusion Avada.This issue affects Avada: from n/a through 7.11.1 |
| CVE-2024-2344 | AV Avada Theme-fusion | 7.2 | Apr 9 | The Avada theme for WordPress is vulnerable to SQL Injection via the 'entry' parameter in all versions up to, and including, 7.11.6 due to insufficient escaping on the user… |
| CVE-2024-2343 | AV Avada Theme-fusion | 6.4 | Apr 9 | The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.11.6 via the… |
| CVE-2024-2340 | AV Avada Theme-fusion | 5.3 | Apr 9 | The Avada theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.11.6 via the '/wp-content/uploads/fusion-forms/' directory |
| CVE-2024-2311 | AV Avada Theme-fusion | 5.4 | Apr 9 | The Avada theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 7.11.6 due to insufficient input… |
| CVE-2023-39313 | AV Avada Theme-fusion | 7.7 | Mar 28 | Server-Side Request Forgery (SSRF) vulnerability in ThemeFusion Avada.This issue affects Avada: from n/a through 7.11.1 |
| CVE-2023-39307 | AV Avada Theme-fusion | 8.8 | Mar 26 | Unrestricted Upload of File with Dangerous Type vulnerability in ThemeFusion Avada.This issue affects Avada: from n/a through 7.11.1 |
| CVE-2024-1668 | AV Avada Theme-fusion | 6.5 | Mar 13 | The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Sensitive Information Exposure in versions up to and including 7.11.5 via the form… |
| CVE-2024-1468 | AV Avada Theme-fusion | 8.8 | Feb 29 | The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the… |
| CVE-2020-36711 | AV Avada Theme-fusion | 5.4 | Jun 7 | The Avada theme for WordPress is vulnerable to Stored Cross-Site Scripting via the update_layout function in versions up to, and including, 6.2.3 due to insufficient input… |
| CVE-2022-41996 | AV Avada Theme-fusion | 8.8 | Oct 27 | WordPress Avada premium theme <= 7.8.1 - Cross-Site Request Forgery (CSRF) vulnerability |
| CVE-2022-1386 | AV Avada Theme-fusion | 9.8 | May 16 | The Fusion Builder WordPress plugin before 3.6.2, used in the Avada theme, does not validate a parameter in its forms which could be used to initiate arbitrary HTTP requests |
| CVE-2017-18607 | AV Avada Theme-fusion | 8.8 | Sep 10 | The avada theme before 5.1.5 for WordPress has CSRF |
| CVE-2017-18606 | AV Avada Theme-fusion | 6.1 | Sep 10 | The avada theme before 5.1.5 for WordPress has stored XSS |