Vendor
themefusion
- CVEs tracked · all time
- 3
- in CISA KEV · all time
- 0
- articles · since 11 Sep
- 0
- articles · all time
- 2
No articles in the last 45 daysThe latest: SecurityOnline, Fri 19 Jun, 08:51 UTC.See the full timeline
Products: Avada (Fusion) Builder
CVEs
3 CVEsCVE-2026-8713Avada (Fusion) Builder <= 3.15.3 - Unauthenticated Arbitrary File Deletion via Form Entry ValueCVSS9.1Critical–Not in KEV3.0%EPSS1article
CVE-2026-4798Avada Builder <= 3.15.1 - Unauthenticated SQL Injection via 'product_order' ParameterCVSS7.5High–Not in KEV0.5%EPSS1article
CVE-2026-4782Avada Builder <= 3.15.2 - Authenticated (Subscriber+) Arbitrary File Read via 'custom_svg' Shortcode ParameterCVSS6.5Medium–Not in KEV0.5%EPSS1article
- CVE-2026-8713 lets attackers delete files in Avada Builder pluginSecurityOnline
- Avada Builder Flaws Expose One Million WordPress SitesInfosecurity · first in our coverage