CVEs we hold for Themefusion
Records whose assigning authority named Themefusion as the affected vendor. Newest identifiers first, capped at 200.
CVE-2026-8713Avada (Fusion) Builder <= 3.15.3 - Unauthenticated Arbitrary File Deletion via Form Entry Valuethemefusion Avada (Fusion) Builder
CVE-2026-65524WordPress Avada Custom Branding plugin <= 1.2 - Broken Access Control vulnerabilityThemeFusion Avada Custom Branding
CVE-2026-6279Avada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics'…themefusion Avada (Fusion) Builder
CVE-2026-56008WordPress Fusion Builder plugin <= 3.15.4 - Privilege Escalation vulnerabilityThemeFusion Fusion Builder
CVE-2026-54194WordPress Fusion Builder plugin <= 3.15.4 - PHP Object Injection vulnerabilityThemeFusion Fusion Builder
CVE-2026-54193WordPress Fusion Builder plugin <= 3.15.4 - Arbitrary File Deletion vulnerabilityThemeFusion Fusion Builder
CVE-2026-4798Avada Builder <= 3.15.1 - Unauthenticated SQL Injection via 'product_order' Parameterthemefusion Avada (Fusion) Builder
CVE-2026-4782Avada Builder <= 3.15.2 - Authenticated (Subscriber+) Arbitrary File Read via 'custom_svg' Shortcode Parameterthemefusion Avada (Fusion) Builder
CVE-2026-32542WordPress Fusion Builder plugin < 3.15.0 - Reflected Cross Site Scripting (XSS) vulnerabilityThemeFusion Fusion Builder
CVE-2026-32454WordPress Avada Core plugin < 5.15.0 - Cross Site Scripting (XSS) vulnerabilityThemeFusion Avada Core
CVE-2026-32453WordPress Avada Core plugin < 5.15.0 - Broken Access Control vulnerabilityThemeFusion Avada Core
CVE-2026-32452WordPress Fusion Builder plugin < 3.15.0 - Broken Access Control vulnerabilityThemeFusion Fusion Builder
CVE-2026-32451WordPress Fusion Builder plugin < 3.15.0 - Broken Access Control vulnerabilityThemeFusion Fusion Builder
CVE-2026-25472WordPress Fusion Builder plugin <= 3.14.1 - Cross Site Scripting (XSS) vulnerabilityThemeFusion Fusion Builder
CVE-2026-18431Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File WriteThemeFusion Avada | Website Builder For WordPress &…
CVE-2026-16654Avada (Fusion) Builder <= 3.15.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' Shortcode…themefusion Avada (Fusion) Builder
CVE-2026-1543Avada (Fusion) Builder <= 3.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Multiple Shortcodesthemefusion Avada (Fusion) Builder
CVE-2026-1541Avada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Sensitive Information Exposure via Insecure Direct…themefusion Avada (Fusion) Builder
CVE-2026-1509Avada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Limited Arbitrary WordPress Action Executionthemefusion Avada (Fusion) Builder
CVE-2026-12536Avada Builder <= 3.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Titlethemefusion Avada (Fusion) Builder
CVE-2025-6747Avada (Fusion) Builder <= 3.12.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodethemefusion Avada (Fusion) Builder
CVE-2025-64634WordPress Avada theme <= 7.13.2 - Broken Access Control vulnerabilityThemeFusion Avada
CVE-2025-58922WordPress Avada theme < 7.13.2 - Cross Site Request Forgery (CSRF) vulnerabilityThemeFusion Avada
CVE-2025-49940WordPress Fusion Builder plugin <= 3.13.2 - Cross Site Scripting (XSS) vulnerabilityThemeFusion Fusion Builder
CVE-2025-24748WordPress Avada theme <= 7.11.10 - Broken Access Control vulnerabilityThemeFusion Avada
CVE-2025-1665Avada Builder <= 3.11.14 - Authenticated (Contributor+) Stored Cross-Site Scriptingthemefusion Avada (Fusion) Builder
CVE-2024-5628Avada | Website Builder For WordPress & eCommerce <= 3.11.9 - Authenticated (Contributor+) Stored Cross-Site Scripting…themefusion Avada (Fusion) Builder
CVE-2024-54357WordPress Avada theme <= 7.11.10 - Cross Site Request Forgery (CSRF) vulnerabilityThemeFusion Avada
CVE-2024-2344Avada <= 7.11.6 - Authenticated (Admin+) SQL Injection via entryThemeFusion Avada | Website Builder For WordPress &…
CVE-2024-2343Avada <= 7.11.6 - Authenticated (Contributor+) Server-Side Request Forgery via form_to_url_actionThemeFusion Avada | Website Builder For WordPress &…
CVE-2024-2340Avada <= 7.11.6 - Unauthenticated Sensitive Information Exposure via Form Uploads Directory ListingThemeFusion Avada | Website Builder For WordPress &…
CVE-2024-2311Avada <= 7.11.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeThemeFusion Avada | Website Builder For WordPress &…
CVE-2024-1668Avada <= 7.11.5 - Authenticated(Contributor+) Sensitive Information Exposure via Form EntriesThemeFusion Avada | Website Builder For WordPress &…
CVE-2024-1468Avada | Website Builder For WordPress & WooCommerce <= 7.11.4 - Authenticated (Contributor+) Arbitrary File UploadThemeFusion Avada | Website Builder For WordPress &…
CVE-2024-13346Avada Theme <= 7.11.13 - Unauthenticated Arbitrary Shortcode ExecutionThemeFusion Avada | Website Builder For WordPress &…
CVE-2024-13345Avada Builder <= 3.11.13 - Unauthenticated Arbitrary Shortcode Executionthemefusion Avada (Fusion) Builder
CVE-2024-12477Avada Builder <= 3.11.11 - Authenticated (Contributor+) Stored Cross-Site Scripting in Multiple Widgetsthemefusion Avada (Fusion) Builder
CVE-2024-12335Avada Builder <= 3.11.12 - Authenticated (Contributor+) Protected Post Disclosurethemefusion Avada (Fusion) Builder
CVE-2023-39922WordPress Avada theme <= 7.11.1 - Authenticated Broken Access Control vulnerabilityThemeFusion Avada
CVE-2023-39313WordPress Avada theme <= 7.11.1 - Authenticated Server Side Request Forgery (SSRF) vulnerabilityThemeFusion Avada
CVE-2023-39312WordPress Avada theme <= 7.11.1 - Auth. Unrestricted Zip Extraction vulnerabilityThemeFusion Avada
CVE-2023-39311WordPress Avada Builder plugin <= 3.11.1 - Cross Site Request Forgery (CSRF) vulnerabilityThemeFusion Fusion Builder
CVE-2023-39310WordPress Avada Builder plugin <= 3.11.1 - Authenticated Broken Access Control vulnerabilityThemeFusion Fusion Builder
CVE-2023-39309WordPress Avada Builder plugin <= 3.11.1 - Auth. SQL Injection vulnerabilityThemeFusion Fusion Builder
CVE-2023-39307WordPress Avada theme <= 7.11.1 - Authenticated Arbitrary File Upload vulnerabilityThemeFusion Avada
CVE-2023-39306WordPress Avada Builder plugin <= 3.11.1 - Reflected Cross Site Scripting (XSS) vulnerabilityThemeFusion Fusion Builder
CVE-2022-41996WordPress Avada premium theme <= 7.8.1 - Cross-Site Request Forgery (CSRF) vulnerabilityThemeFusion Avada (premium WordPress theme)
CVE-2020-36711Avada <= 6.2.2 - Authenticated (Contributor+) Cross-Site ScriptingThemeFusion Avada | Website Builder For WordPress &…
49 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.
Everything on this page is free. Public data. Withholding it protects nothing.