Known vulnerabilities in the Avada (Fusion) Builder theme
10 security advisories have been published for the Avada (Fusion) Builder theme. Each entry below states what an attacker can do, what privilege they need, and the version the issue was fixed in.
- Avada (Fusion) Builder - Cross-Site Scripting (XSS) (CVE-2026-16654) MEDIUM
- Avada (Fusion) Builder - Remote Code Execution (CVE-2026-18431) CRITICAL
- Avada (Fusion) Builder - Cross-Site Scripting (XSS) (CVE-2026-12536) MEDIUM
- Avada (Fusion) Builder - Remote Code Execution (CVE-2026-8713) CRITICAL
- Avada (Fusion) Builder - Remote Code Execution (CVE-2026-6279) CRITICAL
- Avada (Fusion) Builder - Cross-Site Scripting (XSS) (CVE-2026-1543) MEDIUM
- Avada (Fusion) Builder - SQL Injection (CVE-2026-4798) HIGH
- Avada (Fusion) Builder - Information Disclosure (CVE-2026-4782) MEDIUM
- Avada (Fusion) Builder - Path Traversal (CVE-2026-1509) MEDIUM
- Avada (Fusion) Builder - Information Disclosure (CVE-2026-1541) MEDIUM