Avada (Fusion) Builder

Avada (Fusion) Builder has 29 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2026; all 29 are fixed as of September 2026. Their average CVSS score is 6.7, and the most serious one scores 9.8 out of 10. Severity breakdown: 3 critical and 7 high. 2026 was the busiest year with 17 disclosures.

The most common weakness is Cross-Site Scripting, behind 11 of the records (38%). Other recurring categories include Missing Authorization, Authorization Bypass Through User-Controlled Key.

Every one of the 29 issues recorded for Avada (Fusion) Builder has a vendor fix available, so running the current release closes all known holes.

12 independent researchers contributed these findings, most of them (6) reported by Rafie Muhammad.

01234567891019.04.2022Today19.04.20228.3Fusion Builder <= 3.6.1 & Avada <= 7.6.1 - Unauthenticated Server-Side Request Forgery CVSS 8.3 · 19.04.202210.08.20238.8Fusion Builder <= 3.11.1 - Authenticated (Subscriber+) SQL Injection CVSS 8.8 · 10.08.20236.1Fusion Builder <= 3.11.1 - Reflected Cross-Site Scripting via User Register Element CVSS 6.1 · 10.08.20234.3Fusion Builder <= 3.11.1 - Missing Authorization CVSS 4.3 · 10.08.20236.5Fusion Builder <= 3.11.1 - Cross-Site Request Forgery CVSS 6.5 · 10.08.202312.09.20246.4Avada | Website Builder For WordPress & eCommerce <= 3.11.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via fusion_button Shortcode CVSS 6.4 · 12.09.202424.12.20244.3Avada Builder <= 3.11.12 - Authenticated (Contributor+) Protected Post Disclosure CVSS 4.3 · 24.12.202422.01.20256.4Avada Builder <= 3.11.11 - Authenticated (Contributor+) Stored Cross-Site Scripting in Multiple Widgets CVSS 6.4 · 22.01.202512.02.20257.3Avada Builder <= 3.11.13 - Unauthenticated Arbitrary Shortcode Execution CVSS 7.3 · 12.02.202531.03.20256.4Avada Builder <= 3.11.14 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 31.03.202515.07.20256.4Avada (Fusion) Builder <= 3.12.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVSS 6.4 · 15.07.202503.10.20256.4Fusion Builder <= 3.13.2 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 03.10.202515.01.20266.4Avada (Fusion) Builder <= 3.14.1 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 15.01.202610.03.20265.3Avada (Fusion) Builder < 3.15.0 - Missing Authorization CVSS 5.3 · 10.03.20264.3Avada (Fusion) Builder < 3.15.0 - Missing Authorization CVSS 4.3 · 10.03.202620.03.20266.1Avada (Fusion) Builder < 3.15.0 - Reflected Cross-Site Scripting CVSS 6.1 · 20.03.202614.04.20264.3Avada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Sensitive Information Exposure via Insecure Direct Object Reference CVSS 4.3 · 14.04.20265.4Avada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Limited Arbitrary WordPress Action Execution CVSS 5.4 · 14.04.202612.05.20267.5Avada Builder <= 3.15.1 - Unauthenticated SQL Injection via 'product_order' Parameter CVSS 7.5 · 12.05.20266.5Avada Builder <= 3.15.2 - Authenticated (Subscriber+) Arbitrary File Read via 'custom_svg' Shortcode Parameter CVSS 6.5 · 12.05.202620.05.20269.8Avada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler CVSS 9.8 · 20.05.20266.4Avada (Fusion) Builder <= 3.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Multiple Shortcodes CVSS 6.4 · 20.05.202615.06.20267.5Avada (Fusion) Builder <= 3.15.4 - Authenticated (Contributor+) PHP Object Injection CVSS 7.5 · 15.06.202616.06.20268.1Avada (Fusion) Builder <= 3.15.4 - Authenticated (Contributor+) Arbitrary File Deletion CVSS 8.1 · 16.06.202618.06.20268.8Avada (Fusion) Builder <= 3.15.4 - Authenticated (Contributor+) Privilege Escalation CVSS 8.8 · 18.06.20269.1Avada (Fusion) Builder <= 3.15.3 - Unauthenticated Arbitrary File Deletion via Form Entry Value CVSS 9.1 · 18.06.202613.07.20266.4Avada Builder <= 3.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Title CVSS 6.4 · 13.07.202625.08.20269.8Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write CVSS 9.8 · 25.08.202627.08.20266.4Avada (Fusion) Builder <= 3.15.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' Shortcode Attribute CVSS 6.4 · 27.08.2026

Strategic Overview

Avg CVSSMedium
6.7/ 10
Patch Coverage100%
Open

0

Fixed

29

Get automatic notifications for all Avada (Fusion) Builder vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2026-18431

Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write

Read the full analysis

Vulnerability Records

29 records
2026-08-27 15:41
Avada (Fusion) Builder <= 3.15.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' Shortcode Attribute
Avada (Fusion) Builder
<= 3.15.6
CVE-2026-16654
6.4
Medium
João Pedro Soares de AlcântaraYes
2026-08-25 17:44
Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write
Avada (Fusion) Builder
<= 3.16
CVE-2026-18431
9.8
Critical
Alex ThomasYes
2026-07-13 06:13
Avada Builder <= 3.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Title
Avada (Fusion) Builder
<= 3.15.5
CVE-2026-12536
6.4
Medium
Zbigniew PiotrakYes
2026-06-18 16:14
Avada (Fusion) Builder <= 3.15.3 - Unauthenticated Arbitrary File Deletion via Form Entry Value
Avada (Fusion) Builder
<= 3.15.3
CVE-2026-8713
9.1
Critical
darooYes
2026-06-18 00:00
Avada (Fusion) Builder <= 3.15.4 - Authenticated (Contributor+) Privilege Escalation
Avada (Fusion) Builder
<= 3.15.4
CVE-2026-56008
8.8
High
darooYes
2026-06-16 00:00
Avada (Fusion) Builder <= 3.15.4 - Authenticated (Contributor+) Arbitrary File Deletion
Avada (Fusion) Builder
<= 3.15.4
CVE-2026-54193
8.1
High
darooYes
2026-06-15 00:00
Avada (Fusion) Builder <= 3.15.4 - Authenticated (Contributor+) PHP Object Injection
Avada (Fusion) Builder
<= 3.15.4
CVE-2026-54194
7.5
High
darooYes
2026-05-20 16:21
Avada (Fusion) Builder <= 3.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Multiple Shortcodes
Avada (Fusion) Builder
<= 3.15.2
CVE-2026-1543
6.4
Medium
WebbernautYes
2026-05-20 15:45
Avada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler
Avada (Fusion) Builder
<= 3.15.2
CVE-2026-6279
9.8
Critical
Tin Pham (TF1T)Yes
2026-05-12 21:06
Avada Builder <= 3.15.1 - Unauthenticated SQL Injection via 'product_order' Parameter
Avada (Fusion) Builder
<= 3.15.1
CVE-2026-4798
7.5
High
Rafie MuhammadYes
Showing 1–10 of 29 reports

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C