TH
Vendor
ThemeFusion
30
CVEs
0
On KEV
5
New 30D
Products
AF9.8
Avada (Fusion) Builder
themefusion
14 CVEs0 on KEV3 new
AW9.8
Avada | Website Builder For WordPress & WooCommerce
ThemeFusion
3 CVEs0 on KEV2 new
FB9.8
Fusion Builder
ThemeFusion
8 CVEs0 on KEV0 new
AC6.5
Avada Core
ThemeFusion
2 CVEs0 on KEV0 new
AV4.3
Avada
ThemeFusion
1 CVEs0 on KEV0 new
AC4.3
Avada Custom Branding
ThemeFusion
1 CVEs0 on KEV0 new
AP8.8
Avada (premium WordPress theme)
ThemeFusion
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-104729 New | AF Avada (Fusion) Builder themefusion | 6.4 | Oct 28 | Avada (Fusion) Builder <= 3.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tab_index' and 'empty_notice' Shortcode Attributes |
| CVE-2026-97471 | AF Avada (Fusion) Builder themefusion | 5.3 | Oct 14 | Avada (Fusion) Builder <= 3.16.1 - Unauthenticated Sensitive Information Exposure in 'args[link_target]' Parameter via {user_meta} Dynamic Data Token |
| CVE-2026-97340 | AW Avada | Website Builder For WordPress & WooCommerce ThemeFusion | 6.4 | Oct 10 | Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'author_facebook' User Profile Field |
| CVE-2026-97670 | AF Avada (Fusion) Builder themefusion | 9.1 | Oct 10 | Avada (Fusion) Builder <= 7.16.1 - Unauthenticated Arbitrary WordPress Action Invocation via '{action_hook}' Dynamic-Data Token in Form Field |
| CVE-2026-84925 | AW Avada | Website Builder For WordPress & WooCommerce ThemeFusion | 6.1 | Oct 2 | Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Reflected Cross-Site Scripting via 'lang' Parameter |
| CVE-2026-16654 | AF Avada (Fusion) Builder themefusion | 6.4 | Aug 28 | Avada (Fusion) Builder <= 3.15.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' Shortcode Attribute |
| CVE-2026-18431 | AF Avada (Fusion) Builder themefusion | 9.8 | Aug 26 | Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write |
| CVE-2026-65524 | AC Avada Custom Branding ThemeFusion | 4.3 | Jul 23 | WordPress Avada Custom Branding plugin <= 1.2 - Broken Access Control vulnerability |
| CVE-2026-12536 | AF Avada (Fusion) Builder themefusion | 6.4 | Jul 13 | Avada Builder <= 3.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Title |
| CVE-2026-56008 | FB Fusion Builder ThemeFusion | 8.8 | Jun 26 | WordPress Fusion Builder plugin <= 3.15.4 - Privilege Escalation vulnerability |
| CVE-2026-8713 | AF Avada (Fusion) Builder themefusion | 9.1 | Jun 19 | Avada (Fusion) Builder <= 3.15.3 - Unauthenticated Arbitrary File Deletion via Form Entry Value |
| CVE-2026-54193 | FB Fusion Builder ThemeFusion | 7.7 | Jun 17 | WordPress Fusion Builder plugin <= 3.15.4 - Arbitrary File Deletion vulnerability |
| CVE-2026-12256 | FB Fusion Builder ThemeFusion | 8.8 | Jun 16 | WordPress Fusion Builder plugin <= 3.15.3 - PHP Object Injection vulnerability |
| CVE-2026-54194 | FB Fusion Builder ThemeFusion | 9.8 | Jun 16 | WordPress Fusion Builder plugin <= 3.15.4 - PHP Object Injection vulnerability |
| CVE-2026-1543 | AF Avada (Fusion) Builder themefusion | 6.4 | May 21 | Avada (Fusion) Builder <= 3.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Multiple Shortcodes |
| CVE-2026-6279 | AF Avada (Fusion) Builder themefusion | 9.8 | May 21 | Avada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler |
| CVE-2026-4782 | AF Avada (Fusion) Builder themefusion | 6.5 | May 13 | Avada Builder <= 3.15.2 - Authenticated (Subscriber+) Arbitrary File Read via 'custom_svg' Shortcode Parameter |
| CVE-2026-4798 | AF Avada (Fusion) Builder themefusion | 7.5 | May 13 | Avada Builder <= 3.15.1 - Unauthenticated SQL Injection via 'product_order' Parameter |
| CVE-2025-58922 | AV Avada ThemeFusion | 4.3 | Apr 22 | WordPress Avada theme < 7.13.2 - Cross Site Request Forgery (CSRF) vulnerability |
| CVE-2026-1509 | AF Avada (Fusion) Builder themefusion | 5.4 | Apr 15 | Avada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Limited Arbitrary WordPress Action Execution |
| CVE-2026-1541 | AF Avada (Fusion) Builder themefusion | 4.3 | Apr 15 | Avada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Sensitive Information Exposure via Insecure Direct Object Reference |
| CVE-2026-32542 | FB Fusion Builder ThemeFusion | 7.1 | Mar 25 | WordPress Fusion Builder plugin < 3.15.0 - Reflected Cross Site Scripting (XSS) vulnerability |
| CVE-2026-32454 | AC Avada Core ThemeFusion | 6.5 | Mar 13 | WordPress Avada Core plugin < 5.15.0 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-32453 | AC Avada Core ThemeFusion | 5.3 | Mar 13 | WordPress Avada Core plugin < 5.15.0 - Broken Access Control vulnerability |
| CVE-2026-32452 | FB Fusion Builder ThemeFusion | 5.3 | Mar 13 | WordPress Fusion Builder plugin < 3.15.0 - Broken Access Control vulnerability |
| CVE-2026-32451 | FB Fusion Builder ThemeFusion | 6.5 | Mar 13 | WordPress Fusion Builder plugin < 3.15.0 - Broken Access Control vulnerability |
| CVE-2026-25472 | FB Fusion Builder ThemeFusion | 6.5 | Feb 19 | WordPress Fusion Builder plugin <= 3.14.1 - Cross Site Scripting (XSS) vulnerability |
| CVE-2024-12335 | AF Avada (Fusion) Builder themefusion | 4.3 | Dec 25 | Avada Builder <= 3.11.12 - Authenticated (Contributor+) Protected Post Disclosure |
| CVE-2022-41996 | AP Avada (premium WordPress theme) ThemeFusion | 8.8 | Oct 27 | WordPress Avada premium theme <= 7.8.1 - Cross-Site Request Forgery (CSRF) vulnerability |