Vulnerabilities

TI-2025-40002 CVE-2025-64634 · GHSA-7vv7-972j-884w

WordPress Avada theme <= 7.13.2 - Broken Access Control vulnerability

LOW 26

Missing Authorization vulnerability in ThemeFusion Avada avada allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Avada: from n/a through <= 7.13.2.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00254 Published 2025-12-16 No fix listed CWE-862

TI-2024-12389 CVE-2024-13346 · GHSA-6v5g-5362-mj6f

Avada Theme <= 7.11.13 - Unauthenticated Arbitrary Shortcode Execution

MEDIUM 52

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 7.11.13.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02297 Published 2025-02-13 No fix listed CWE-94

TI-2024-36445 CVE-2024-54357 · GHSA-mqj4-rjv9-gp22

WordPress Avada theme <= 7.11.10 - Cross Site Request Forgery (CSRF) vulnerability

LOW 19

Cross-Site Request Forgery (CSRF) vulnerability in ThemeFusion Avada avada.This issue affects Avada: from n/a through <= 7.11.10.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00183 Published 2024-12-16 No fix listed CWE-352

TI-2024-05225 CVE-2024-5628 · GHSA-f78v-vf29-36gj

Cross-site scripting in ThemeFusion Avada Builder

LOW 28

The Avada | Website Builder For WordPress & eCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's fusion_button shortcode in all versions up to, and including, 3.11.9 due to insuffi…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00322 Published 2024-09-13 No fix listed CWE-79

TI-2023-20455 CVE-2023-39312 · GHSA-wcwp-h8hq-8j75

WordPress Avada theme <= 7.11.1 - Auth. Unrestricted Zip Extraction vulnerability

MEDIUM 42

Missing Authorization vulnerability in ThemeFusion Avada.This issue affects Avada: from n/a through 7.11.1.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00593 Published 2024-06-19 No fix listed CWE-862

TI-2023-20821 CVE-2023-39922 · GHSA-372m-pqrp-g3mw

WordPress Avada theme <= 7.11.1 - Authenticated Broken Access Control vulnerability

LOW 38

Missing Authorization vulnerability in ThemeFusion Avada.This issue affects Avada: from n/a through 7.11.1.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00374 Published 2024-06-19 No fix listed CWE-862

TI-2024-02148 CVE-2024-2311 · GHSA-fgjr-q739-ggx5

Avada <= 7.11.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

LOW 30

The Avada theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 7.11.6 due to insufficient input sanitization and output escaping on user suppl…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00688 Published 2024-04-09 No fix listed CWE-79

TI-2024-02179 CVE-2024-2344 · GHSA-88wh-w28v-xrhh

Avada <= 7.11.6 - Authenticated (Admin+) SQL Injection via entry

LOW 35

The Avada theme for WordPress is vulnerable to SQL Injection via the 'entry' parameter in all versions up to, and including, 7.11.6 due to insufficient escaping on the user supplied parameter and lack of sufficient prepa…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00828 Published 2024-04-09 No fix listed CWE-89

TI-2024-02175 CVE-2024-2340 · GHSA-wvrc-7835-9grj

Avada <= 7.11.6 - Unauthenticated Sensitive Information Exposure via Form Uploads Directory Listing

MEDIUM 53

The Avada theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.11.6 via the '/wp-content/uploads/fusion-forms/' directory.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.27997 Published 2024-04-09 No fix listed CWE-548

TI-2024-02178 CVE-2024-2343 · GHSA-2x2m-2fw2-whqj

Avada <= 7.11.6 - Authenticated (Contributor+) Server-Side Request Forgery via form_to_url_action

LOW 29

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.11.6 via the form_to_url_action function.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00517 Published 2024-04-09 No fix listed CWE-918

TI-2023-20456 CVE-2023-39313 · GHSA-w89j-gj5w-5g57

WordPress Avada theme <= 7.11.1 - Authenticated Server Side Request Forgery (SSRF) vulnerability

LOW 34

Server-Side Request Forgery (SSRF) vulnerability in ThemeFusion Avada.This issue affects Avada: from n/a through 7.11.1.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00571 Published 2024-03-28 No fix listed CWE-918

TI-2023-20450 CVE-2023-39307 · GHSA-fg4p-3qhr-755g

WordPress Avada theme <= 7.11.1 - Authenticated Arbitrary File Upload vulnerability

MEDIUM 41

Unrestricted Upload of File with Dangerous Type vulnerability in ThemeFusion Avada.This issue affects Avada: from n/a through 7.11.1.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00673 Published 2024-03-26 No fix listed CWE-434

TI-2024-01549 CVE-2024-1668 · GHSA-pxwf-ppfx-m7xm

Avada <= 7.11.5 - Authenticated(Contributor+) Sensitive Information Exposure via Form Entries

LOW 30

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Sensitive Information Exposure in versions up to and including 7.11.5 via the form entries page.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00658 Published 2024-03-13 No fix listed CWE-284

TI-2024-01371 CVE-2024-1468 · GHSA-6rj2-w8v9-xrxq

Avada | Website Builder For WordPress & WooCommerce <= 7.11.4 - Authenticated (Contributor+) Arbitrary File Upload

MEDIUM 42

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajax_import_options() function in all versions up to, and inc…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01151 Published 2024-02-29 No fix listed CWE-434

TI-2020-18882 CVE-2020-36711 · GHSA-pf5j-34m8-jf87

Avada <= 6.2.2 - Authenticated (Contributor+) Cross-Site Scripting

LOW 29

The Avada theme for WordPress is vulnerable to Stored Cross-Site Scripting via the update_layout function in versions up to, and including, 6.2.3 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00648 Published 2023-06-07 Fixed in 6.2.3 CWE-79

TI-2022-20336 CVE-2022-41996 · GHSA-p589-wfww-6cff

WordPress Avada premium theme <= 7.8.1 - Cross-Site Request Forgery (CSRF) vulnerability

MEDIUM 41

Cross-Site Request Forgery (CSRF) vulnerability in ThemeFusion Avada premium theme versions <= 7.8.1 on WordPress leading to arbitrary plugin installation/activation.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00595 Published 2022-10-27 No fix listed CWE-352

TI-2022-01267 CVE-2022-1386 · GHSA-4gm2-r6xm-jqxh

Fusion Builder < 3.6.2 - Unauthenticated SSRF

HIGH 80

The Fusion Builder WordPress plugin before 3.6.2, used in the Avada theme, does not validate a parameter in its forms which could be used to initiate arbitrary HTTP requests.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.71427 Published 2022-05-16 Fixed in 3.6.2 CWE-918

TI-2017-13780 CVE-2017-18607 · GHSA-ww7w-rxj3-c9r3

The avada theme before 5.1.5 for WordPress has CSRF.

LOW 39

The avada theme before 5.1.5 for WordPress has CSRF.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00669 Published 2019-09-10 No fix listed CWE-352

TI-2017-13779 CVE-2017-18606 · GHSA-92fc-2v24-8558

The avada theme before 5.1.5 for WordPress has stored XSS.

LOW 29

The avada theme before 5.1.5 for WordPress has stored XSS.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00907 Published 2019-09-10 No fix listed CWE-79

Vulnerabilities

Filters