Known Vulnerabilities for Avada by ThemeFusion
Listed below are 5 of the newest known vulnerabilities associated with "Avada" by "ThemeFusion".
These CVEs are retrieved based on exact matches on listed software, hardware, and vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed software information are still displayed.
Data on known vulnerable versions is also displayed based on information from known CPEs
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-65524 json | Contributor Broken Access Control in Avada Custom Branding <= 1.2 versions. | Not Provided | 2026-07-23 | 2026-07-23 |
| CVE-2026-65471 json | Unauthenticated Cross Site Request Forgery (CSRF) in Avada Core <= 5.15.6 versions. | Not Provided | 2026-07-23 | 2026-07-23 |
| CVE-2026-18431 json | The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusio... | Not Provided | 2026-08-26 | 2026-08-27 |
| CVE-2026-16654 json | The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'size' Shortcode Attribute i... | Not Provided | 2026-08-28 | 2026-08-28 |
| CVE-2026-12536 json | The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Module Title’ param... | Not Provided | 2026-07-13 | 2026-07-14 |