Avada | Website Builder For WordPress & WooCommerce

Avada | Website Builder For WordPress & WooCommerce has 26 disclosed vulnerabilities in the WordSec catalog, reported between 2017 and 2026; all 26 are fixed as of October 2026. Their average CVSS score is 6.8, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 10 high. 2024 was the busiest year with 7 disclosures.

The most common weakness is Cross-Site Scripting, behind 7 of the records (27%). Other recurring categories include Cross-Site Request Forgery (CSRF), Missing Authorization.

Every one of the 26 issues recorded for Avada | Website Builder For WordPress & WooCommerce has a vendor fix available, so running the current release closes all known holes.

12 independent researchers contributed these findings, most of them (6) reported by Muhammad Zeeshan (Xib3rR4dAr).

01234567891026.04.2017Today26.04.20178.8Avada <= 5.1.4 - Cross-Site Request Forgery CVSS 8.8 · 26.04.20176.1Avada <= 5.1.4 - Stored Cross-Site Scripting CVSS 6.1 · 26.04.201724.04.20206.4Avada <= 6.2.2 - Authenticated (Contributor+) Cross-Site Scripting CVSS 6.4 · 24.04.202010.09.20216.4Avada <= 7.4.1 - Stored Cross-Site Scripting CVSS 6.4 · 10.09.20216.1Avada <= 7.4.1 - Reflected Cross-Site Scripting CVSS 6.1 · 10.09.202119.04.20228.3Fusion Builder <= 3.6.1 & Avada <= 7.6.1 - Unauthenticated Server-Side Request Forgery CVSS 8.3 · 19.04.202221.09.20228.8Avada <= 7.8.1 - Cross-Site Request Forgery CVSS 8.8 · 21.09.202210.08.20237.5Avada <= 7.11.1 - Authenticated(Contributor+) Arbitrary File Upload via 'ajax_import_options' CVSS 7.5 · 10.08.20234.3Avada <= 7.11.1 - Missing Authorization CVSS 4.3 · 10.08.20238.8Avada <= 7.11.1 - Authenticated(Author+) Arbitrary File Upload via Zip Extraction CVSS 8.8 · 10.08.20238.5Avada <= 7.11.1 - Authenticated(Contributor+) Server Side Request Forgery via 'ajax_import_options' CVSS 8.5 · 10.08.202328.02.20248.8Avada | Website Builder For WordPress & WooCommerce <= 7.11.4 - Authenticated (Contributor+) Arbitrary File Upload CVSS 8.8 · 28.02.202401.03.20246.5Avada <= 7.11.5 - Authenticated(Contributor+) Sensitive Information Exposure via Form Entries CVSS 6.5 · 01.03.202420.03.20246.4Avada <= 7.11.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVSS 6.4 · 20.03.20247.2Avada <= 7.11.6 - Authenticated (Admin+) SQL Injection via entry CVSS 7.2 · 20.03.20245.3Avada <= 7.11.6 - Unauthenticated Sensitive Information Exposure via Form Uploads Directory Listing CVSS 5.3 · 20.03.20246.4Avada <= 7.11.6 - Authenticated (Contributor+) Server-Side Request Forgery via form_to_url_action CVSS 6.4 · 20.03.202411.12.20244.3Avada <= 7.11.10 - Cross-Site Request Forgery CVSS 4.3 · 11.12.202424.01.20255.3Avada <= 7.11.10 - Missing Authorization CVSS 5.3 · 24.01.202512.02.20257.3Avada Theme <= 7.11.13 - Unauthenticated Arbitrary Shortcode Execution CVSS 7.3 · 12.02.202503.10.20254.3Avada <= 7.13.2 - Missing Authorization CVSS 4.3 · 03.10.202522.04.20264.3Avada < 7.13.2 - Cross-Site Request Forgery CVSS 4.3 · 22.04.202615.06.20267.5Avada <= 3.15.3 - Authenticated (Contributor+) PHP Object Injection CVSS 7.5 · 15.06.202625.08.20269.8Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write CVSS 9.8 · 25.08.202601.10.20266.1Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Reflected Cross-Site Scripting via 'lang' Parameter CVSS 6.1 · 01.10.202609.10.20266.4Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'author_facebook' User Profile Field CVSS 6.4 · 09.10.2026

Strategic Overview

Avg CVSSMedium
6.8/ 10
Patch Coverage100%
Open

0

Fixed

26

Get automatic notifications for all Avada | Website Builder For WordPress & WooCommerce vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2026-18431

Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write

Read the full analysis

Vulnerability Records

26 records
2026-10-09 19:26
Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'author_facebook' User Profile Field
Avada
<= 7.16.1
CVE-2026-97340
6.4
Medium
Muhamad VisatYes
2026-10-01 16:39
Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Reflected Cross-Site Scripting via 'lang' Parameter
Avada
<= 7.16.1
CVE-2026-84925
6.1
Medium
darooYes
2026-08-25 17:44
Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write
Avada
<= 7.16
CVE-2026-18431
9.8
Critical
Alex ThomasYes
2026-06-15 00:00
Avada <= 3.15.3 - Authenticated (Contributor+) PHP Object Injection
Avada
<= 3.15.3
CVE-2026-12256
7.5
High
darooYes
2026-04-22 00:00
Avada < 7.13.2 - Cross-Site Request Forgery
Avada
< 7.13.2
CVE-2025-58922
4.3
Medium
João Pedro Soares de AlcântaraYes
2025-10-03 00:00
Avada <= 7.13.2 - Missing Authorization
Avada
<= 7.13.2
CVE-2025-64634
4.3
Medium
João Pedro Soares de AlcântaraYes
2025-02-12 00:00
Avada Theme <= 7.11.13 - Unauthenticated Arbitrary Shortcode Execution
Avada
<= 7.11.13
CVE-2024-13346
7.3
High
Michael MazzoliniYes
2025-01-24 00:00
Avada <= 7.11.10 - Missing Authorization
Avada
<= 7.11.10
CVE-2025-24748
5.3
Medium
Ananda DhakalYes
2024-12-11 00:00
Avada <= 7.11.10 - Cross-Site Request Forgery
Avada
<= 7.11.10
CVE-2024-54357
4.3
Medium
Ananda DhakalYes
2024-03-20 00:00
Avada <= 7.11.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Avada
<= 7.11.6
CVE-2024-2311
6.4
Medium
Muhammad Zeeshan (Xib3rR4dAr)Yes
Showing 1–10 of 26 reports

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C