WordSec
WordSec

Avada (Fusion) Builder

Explore Avada (Fusion) Builder vulnerabilities across all versions. Currently tracking 27 known vulnerabilities, including severity, impact, and patch status.

01234567891019.04.2022Today19.04.20228.3Fusion Builder <= 3.6.1 & Avada <= 7.6.1 - Unauthenticated Server-Side Request Forgery CVSS 8.3 · 19.04.202210.08.20238.8Fusion Builder <= 3.11.1 - Authenticated (Subscriber+) SQL Injection CVSS 8.8 · 10.08.20236.1Fusion Builder <= 3.11.1 - Reflected Cross-Site Scripting via User Register Element CVSS 6.1 · 10.08.20234.3Fusion Builder <= 3.11.1 - Missing Authorization CVSS 4.3 · 10.08.20236.5Fusion Builder <= 3.11.1 - Cross-Site Request Forgery CVSS 6.5 · 10.08.202312.09.20246.4Avada | Website Builder For WordPress & eCommerce <= 3.11.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via fusion_button Shortcode CVSS 6.4 · 12.09.202424.12.20244.3Avada Builder <= 3.11.12 - Authenticated (Contributor+) Protected Post Disclosure CVSS 4.3 · 24.12.202422.01.20256.4Avada Builder <= 3.11.11 - Authenticated (Contributor+) Stored Cross-Site Scripting in Multiple Widgets CVSS 6.4 · 22.01.202512.02.20257.3Avada Builder <= 3.11.13 - Unauthenticated Arbitrary Shortcode Execution CVSS 7.3 · 12.02.202531.03.20256.4Avada Builder <= 3.11.14 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 31.03.202515.07.20256.4Avada (Fusion) Builder <= 3.12.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVSS 6.4 · 15.07.202503.10.20256.4Fusion Builder <= 3.13.2 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 03.10.202515.01.20266.4Avada (Fusion) Builder <= 3.14.1 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 15.01.202610.03.20265.3Avada (Fusion) Builder < 3.15.0 - Missing Authorization CVSS 5.3 · 10.03.20264.3Avada (Fusion) Builder < 3.15.0 - Missing Authorization CVSS 4.3 · 10.03.202620.03.20266.1Avada (Fusion) Builder < 3.15.0 - Reflected Cross-Site Scripting CVSS 6.1 · 20.03.202614.04.20264.3Avada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Sensitive Information Exposure via Insecure Direct Object Reference CVSS 4.3 · 14.04.20265.4Avada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Limited Arbitrary WordPress Action Execution CVSS 5.4 · 14.04.202612.05.20267.5Avada Builder <= 3.15.1 - Unauthenticated SQL Injection via 'product_order' Parameter CVSS 7.5 · 12.05.20266.5Avada Builder <= 3.15.2 - Authenticated (Subscriber+) Arbitrary File Read via 'custom_svg' Shortcode Parameter CVSS 6.5 · 12.05.202620.05.20269.8Avada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler CVSS 9.8 · 20.05.20266.4Avada (Fusion) Builder <= 3.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Multiple Shortcodes CVSS 6.4 · 20.05.202615.06.20267.5Avada (Fusion) Builder <= 3.15.4 - Authenticated (Contributor+) PHP Object Injection CVSS 7.5 · 15.06.202616.06.20268.1Avada (Fusion) Builder <= 3.15.4 - Authenticated (Contributor+) Arbitrary File Deletion CVSS 8.1 · 16.06.202618.06.20268.8Avada (Fusion) Builder <= 3.15.4 - Authenticated (Contributor+) Privilege Escalation CVSS 8.8 · 18.06.20269.1Avada (Fusion) Builder <= 3.15.3 - Unauthenticated Arbitrary File Deletion via Form Entry Value CVSS 9.1 · 18.06.202613.07.20266.4Avada Builder <= 3.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Title CVSS 6.4 · 13.07.2026

Strategic Overview

Avg CVSSMedium
6.6/ 10
Patch Coverage100%
Open

0

Fixed

27

Get automatic notifications for all Avada (Fusion) Builder vulnerabilities before they are exploited.

Vulnerability Records

27 records
2026-07-13 06:13
Avada Builder <= 3.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Title
Avada (Fusion) Builder
<= 3.15.5
CVE-2026-12536
6.4
Medium
Zbigniew PiotrakYes
2026-06-18 16:14
Avada (Fusion) Builder <= 3.15.3 - Unauthenticated Arbitrary File Deletion via Form Entry Value
Avada (Fusion) Builder
<= 3.15.3
CVE-2026-8713
9.1
Critical
darooYes
2026-06-18 00:00
Avada (Fusion) Builder <= 3.15.4 - Authenticated (Contributor+) Privilege Escalation
Avada (Fusion) Builder
<= 3.15.4
CVE-2026-56008
8.8
High
darooYes
2026-06-16 00:00
Avada (Fusion) Builder <= 3.15.4 - Authenticated (Contributor+) Arbitrary File Deletion
Avada (Fusion) Builder
<= 3.15.4
CVE-2026-54193
8.1
High
darooYes
2026-06-15 00:00
Avada (Fusion) Builder <= 3.15.4 - Authenticated (Contributor+) PHP Object Injection
Avada (Fusion) Builder
<= 3.15.4
CVE-2026-54194
7.5
High
darooYes
2026-05-20 16:21
Avada (Fusion) Builder <= 3.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Multiple Shortcodes
Avada (Fusion) Builder
<= 3.15.2
CVE-2026-1543
6.4
Medium
WebbernautYes
2026-05-20 15:45
Avada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler
Avada (Fusion) Builder
<= 3.15.2
CVE-2026-6279
9.8
Critical
Tin Pham (TF1T)Yes
2026-05-12 21:06
Avada Builder <= 3.15.1 - Unauthenticated SQL Injection via 'product_order' Parameter
Avada (Fusion) Builder
<= 3.15.1
CVE-2026-4798
7.5
High
Rafie MuhammadYes
2026-05-12 21:06
Avada Builder <= 3.15.2 - Authenticated (Subscriber+) Arbitrary File Read via 'custom_svg' Shortcode Parameter
Avada (Fusion) Builder
<= 3.15.2
CVE-2026-4782
6.5
Medium
Rafie MuhammadYes
2026-04-14 12:25
Avada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Limited Arbitrary WordPress Action Execution
Avada (Fusion) Builder
<= 3.15.1
CVE-2026-1509
5.4
Medium
WebbernautYes
Showing 1–10 of 27 reports

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C