Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-10
Avada (Fusion) Builder - Security Vulnerability (CVE-2026-84938)
The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Form Notification Dynamic-Data action_hook → Media Upload Chain (ID3 Metadata / html_attributes) in all versions up to, and including, 3.16.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that a Fusion Form is embedded on an admin-authored page (granting manage_options context to the Dynamic Data action hook callback), and that…
PLUGIN
Avada (Fusion) Builder
CVE-2026-84938
Risk Score
Threat Entry
Updated 2026-10-10
Avada (Fusion) Builder - Security Vulnerability (CVE-2026-97670)
The Avada (Fusion) Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16.1. This is due to the plugin not properly verifying authorization before dispatching a WordPress action hook whose name is taken from an attacker-supplied form-field value (via the notification email_message [field] placeholder and the {action_hook,...} dynamic-data token; the 3.16.1 trust gate is_content_request_supplied() only inspects $_POST['args']/$_GET['args'], never the $_POST['formData'] the public form-submit endpoint parses). This makes it possible for unauthenticated attackers to invoke arbitrary WordPress action hooks (multiple per request), causing state…
PLUGIN
Avada (Fusion) Builder
CVE-2026-97670
Risk Score
Threat Entry
Updated 2026-08-28
Avada (Fusion) Builder - Cross-Site Scripting (XSS) (CVE-2026-16654)
The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'size' Shortcode Attribute in all versions up to, and including, 3.15.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. WordPress's wp_kses_post filter does not neutralize the payload because the injected content resides entirely within a shortcode attribute string containing no HTML angle brackets, causing kses to pass…
PLUGIN
Avada (Fusion) Builder
CVE-2026-16654
Risk Score
Threat Entry
Updated 2026-07-14
Avada (Fusion) Builder - Cross-Site Scripting (XSS) (CVE-2026-12536)
The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Module Title’ parameter in all versions up to, and including, 3.15.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Avada (Fusion) Builder
CVE-2026-12536
Risk Score
Threat Entry
Updated 2026-06-22
Avada (Fusion) Builder - Remote Code Execution (CVE-2026-8713)
The Avada (Fusion) Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the maybe_delete_files function in all versions up to, and including, 3.15.3. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The attack requires a published Avada form configured to save entries to the database; an unauthenticated attacker submits a path-traversal payload via the wp_ajax_nopriv_fusion_form_submit_ajax handler while also controlling…
THEME
Avada (Fusion) Builder
CVE-2026-8713
Risk Score
Threat Entry
Updated 2026-07-23
Avada (Fusion) Builder - Cross-Site Scripting (XSS) (CVE-2026-1543)
The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcodes in all versions up to, and including, 3.15.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user (typically an administrator) accesses a page displaying dynamic user data (such as via the Dynamic Data feature pulling user biographical information).
PLUGIN
Avada (Fusion) Builder
CVE-2026-1543
Risk Score
Threat Entry
Updated 2026-06-17
Avada (Fusion) Builder - Path Traversal (CVE-2026-1509)
The Avada (Fusion) Builder plugin for WordPress is vulnerable to Arbitrary WordPress Action Execution in all versions up to, and including, 3.15.1. This is due to the plugin's `output_action_hook()` function accepting user-controlled input to trigger any registered WordPress action hook without proper authorization checks. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary WordPress action hooks via the Dynamic Data feature, potentially leading to privilege escalation, file inclusion, denial of service, or other security impacts depending on which action hooks are available in the…
THEME
Avada (Fusion) Builder
CVE-2026-1509
Risk Score
Threat Entry
Updated 2026-06-17
Avada (Fusion) Builder - Information Disclosure (CVE-2026-1541)
The Avada (Fusion) Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.15.1. This is due to the plugin's `fusion_get_post_custom_field()` function failing to validate whether metadata keys are protected (underscore-prefixed). This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract protected post metadata fields that should not be publicly accessible via the Dynamic Data feature's `post_custom_field` parameter.
THEME
Avada (Fusion) Builder
CVE-2026-1541
Risk Score
Threat Entry
Updated 2026-06-17
Avada (Fusion) Builder - Cross-Site Scripting (XSS) (CVE-2025-6747)
The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fusion_map' shortcode in all versions up to, and including, 3.12.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
THEME
Avada (Fusion) Builder
CVE-2025-6747
Risk Score
Threat Entry
Updated 2026-06-17
Avada (Fusion) Builder - Cross-Site Scripting (XSS) (CVE-2025-1665)
The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of the plugin's shortcodes in all versions up to, and including, 3.11.14 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Avada (Fusion) Builder
CVE-2025-1665
Risk Score
Threat Entry
Updated 2026-06-17
Avada (Fusion) Builder - Information Disclosure (CVE-2024-12335)
The Avada (Fusion) Builder plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.11.12 via the handle_clone_post() function and the 'fusion_blog' shortcode and due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to.
PLUGIN
Avada (Fusion) Builder
CVE-2024-12335
Risk Score