Avada | Website Builder For WordPress & WooCommerce

Avada | Website Builder For WordPress & WooCommerce has 24 disclosed vulnerabilities in the WordSec catalog, reported between 2017 and 2026; all 24 are fixed as of September 2026. Their average CVSS score is 6.8, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 10 high. 2024 was the busiest year with 7 disclosures.

The most common weakness is Cross-Site Scripting, behind 5 of the records (21%). Other recurring categories include Cross-Site Request Forgery (CSRF), Missing Authorization.

Every one of the 24 issues recorded for Avada | Website Builder For WordPress & WooCommerce has a vendor fix available, so running the current release closes all known holes.

11 independent researchers contributed these findings, most of them (6) reported by Muhammad Zeeshan (Xib3rR4dAr).

Strategic Overview

Avg CVSSMedium

6.8/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Avada | Website Builder For WordPress & WooCommerce vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2026-18431

Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write

Read the full analysis

Vulnerability Records

24 records


2026-08-25 17:44	Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write Avada <= 7.16	`CVE-2026-18431`	9.8 Critical	Alex Thomas	Yes
2026-06-15 00:00	Avada <= 3.15.3 - Authenticated (Contributor+) PHP Object Injection Avada <= 3.15.3	`CVE-2026-12256`	7.5 High	daroo	Yes
2026-04-22 00:00	Avada < 7.13.2 - Cross-Site Request Forgery Avada < 7.13.2	`CVE-2025-58922`	4.3 Medium	João Pedro Soares de Alcântara	Yes
2025-10-03 00:00	Avada <= 7.13.2 - Missing Authorization Avada <= 7.13.2	`CVE-2025-64634`	4.3 Medium	João Pedro Soares de Alcântara	Yes
2025-02-12 00:00	Avada Theme <= 7.11.13 - Unauthenticated Arbitrary Shortcode Execution Avada <= 7.11.13	`CVE-2024-13346`	7.3 High	mikemyers	Yes
2025-01-24 00:00	Avada <= 7.11.10 - Missing Authorization Avada <= 7.11.10	`CVE-2025-24748`	5.3 Medium	Ananda Dhakal	Yes
2024-12-11 00:00	Avada <= 7.11.10 - Cross-Site Request Forgery Avada <= 7.11.10	`CVE-2024-54357`	4.3 Medium	Ananda Dhakal	Yes
2024-03-20 00:00	Avada <= 7.11.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Avada <= 7.11.6	`CVE-2024-2311`	6.4 Medium	Muhammad Zeeshan (Xib3rR4dAr)	Yes
2024-03-20 00:00	Avada <= 7.11.6 - Authenticated (Admin+) SQL Injection via entry Avada <= 7.11.6	`CVE-2024-2344`	7.2 High	Muhammad Zeeshan (Xib3rR4dAr)	Yes
2024-03-20 00:00	Avada <= 7.11.6 - Unauthenticated Sensitive Information Exposure via Form Uploads Directory Listing Avada <= 7.11.6	`CVE-2024-2340`	5.3 Medium	Muhammad Zeeshan (Xib3rR4dAr)	Yes

Showing 1–10 of 24 reports