sales@hackhalt.com
Free Download

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total26
Critical3
High9
Medium14
Reset
Showing 1-20 of 26 records
Threat Entry Updated 2026-10-30

Avada - Security Vulnerability (CVE-2026-115346)

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 7.16.2 via the convert_palette_images_to_truecolor() function. This is due to insufficient file type validation before processing uploaded files. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.

THEME Avada

CVE-2026-115346

HIGH CVSS 8.1 2026-10-30
Open Full Technical Breakdown
Threat Entry Updated 2026-10-11

Avada - Security Vulnerability (CVE-2026-97340)

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Stored Cross-Site Scripting via the user profile 'Author Page' social link contact-method fields (author_facebook, author_twitter, author_linkedin, author_dribble, author_whatsapp, author_email) in versions up to, and including, 7.16.1. Avada registers these fields through the user_contactmethods filter and, on the author archive, emits them inside an anchor href using only esc_attr() in Fusion_Social_Icon::get_markup(), which escapes HTML metacharacters but does not reject dangerous URL schemes such as javascript:. This makes it possible for authenticated attackers, with Subscriber-level access and…

THEME Avada

CVE-2026-97340

MEDIUM CVSS 6.4 2026-10-10
Open Full Technical Breakdown
Threat Entry Updated 2026-10-02

Avada - Security Vulnerability (CVE-2026-84925)

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'lang' parameter in all versions up to, and including, 7.16.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The injected value is propagated through Fusion_Multilingual::set_active_language() and concatenated into a URL by Fusion_Settings::get_setting_link() without applying urlencode(), esc_url(), or…

THEME Avada

CVE-2026-84925

MEDIUM CVSS 6.1 2026-10-02
Open Full Technical Breakdown
Threat Entry Updated 2026-08-27

Avada - Remote Code Execution (CVE-2026-18431)

The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16. This is due to a chain of authorization and input validation weaknesses across the two components that makes it possible for unauthenticated attackers to write attacker-controlled files to the server. This can be used to create and execute arbitrary PHP files, resulting in remote code execution and complete site compromise. Successful exploitation requires both Avada…

THEME Avada

CVE-2026-18431

CRITICAL CVSS 9.8 2026-08-26
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Avada - Security Vulnerability (CVE-2024-13346)

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 7.11.13. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

PLUGIN Avada

CVE-2024-13346

HIGH CVSS 7.3 2025-02-13
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Avada - Cross-Site Scripting (XSS) (CVE-2024-5628)

The Avada | Website Builder For WordPress & eCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's fusion_button shortcode in all versions up to, and including, 3.11.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability was partially fixed in 3.11.9. Additional hardening for alternate attack vectors was added to version…

PLUGIN Avada

CVE-2024-5628

MEDIUM CVSS 6.4 2024-09-13
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Avada - SQL Injection (CVE-2024-2344)

The Avada theme for WordPress is vulnerable to SQL Injection via the 'entry' parameter in all versions up to, and including, 7.11.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticted attackers, with editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

PLUGIN Avada

CVE-2024-2344

HIGH CVSS 7.2 2024-04-09
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Avada - Server-Side Request Forgery (SSRF) (CVE-2024-2343)

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.11.6 via the form_to_url_action function. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

PLUGIN Avada

CVE-2024-2343

MEDIUM CVSS 6.4 2024-04-09
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Avada - Arbitrary File Upload (CVE-2024-2340)

The Avada theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.11.6 via the '/wp-content/uploads/fusion-forms/' directory. This makes it possible for unauthenticated attackers to extract sensitive data uploaded via an Avada created form with a file upload mechanism.

PLUGIN Avada

CVE-2024-2340

MEDIUM CVSS 5.3 2024-04-09
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Avada - Cross-Site Scripting (XSS) (CVE-2024-2311)

The Avada theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 7.11.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Avada

CVE-2024-2311

MEDIUM CVSS 6.4 2024-04-09
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Avada - Information Disclosure (CVE-2024-1668)

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Sensitive Information Exposure in versions up to and including 7.11.5 via the form entries page. This makes it possible for authenticated attackers, with contributor access and above, to view the contents of all form submissions, including fields that are obfuscated (such as the contact form's "password" field).

PLUGIN Avada

CVE-2024-1668

MEDIUM CVSS 6.5 2024-03-13
Open Full Technical Breakdown

WordPress security that blocks attacks before they land.

sales@hackhalt.com

Product

Resources

Company

© Hack Halt Inc. All rights reserved.