themefusion product
Avada (Fusion) Builder
Tracked since 13 May · latest article 19 Jun · RSS · API
None open
of 0 in the full CISA catalogue · all time
EPSS top 5%, not in KEV
none this week
Exploited, by due date
No Avada (Fusion) Builder CVE is in the CISA KEV catalogue.
Patch cadence and exploit odds
How often CISA adds Avada (Fusion) Builder CVEs, how many have a fix, and where their exploit odds sit.
Added to CISA KEV per quarter
CISA has not added a Avada (Fusion) Builder CVE to KEV.
Fix listed
0 of 3 CVEs in coverage
3 CVEs have no vendor fix recorded yet.
EPSS percentile of each CVE
One dot per CVE; a red diamond marks those in CISA KEV.
Show as tableHide table
| CVE | EPSS percentile |
|---|---|
| CVE-2026-8713 | 87.4 |
| CVE-2026-4798 | 43.6 |
| CVE-2026-4782 | 40.9 |
Coverage2 articles · all time
The latest 2 articles naming Avada (Fusion) Builder, in the shared story grammar.
2 articles from 2 outlets since 13 May. Quiet since 19 Jun.
- Wed 13 May, 14:12 UTC. Infosecurity, first report. Avada Builder Flaws Expose One Million WordPress Sites.
- Fri 19 Jun, 08:51 UTC. SecurityOnline, its first report on the story. CVE-2026-8713 lets attackers delete files in Avada Builder plugin.
- CVE not in KEV
- No CVE
- Larger: an outlet’s first report
- Coverage over time
- Quiet time, folded
Show all 2 articles as a listHide the list
- Wed 13 MayDay 01
- Avada Builder Flaws Expose One Million WordPress Sites14:12 · Infosecurity · First report
Quiet for 5 weeks
Fri 19 JunDay 371- CVE-2026-8713 lets attackers delete files in Avada Builder plugin08:51 · SecurityOnline · Picked up again
All CVEs in coverage3
Exploited first, then by EPSS
Avada (Fusion) Builder <= 3.15.3 - Unauthenticated Arbitrary File Deletion via Form Entry Value
9.1Critical3.0% EPSS · 1 articleAvada Builder <= 3.15.1 - Unauthenticated SQL Injection via 'product_order' Parameter
7.5High0.5% EPSS · 1 articleAvada Builder <= 3.15.2 - Authenticated (Subscriber+) Arbitrary File Read via 'custom_svg' Shortcode Parameter
6.5Medium0.5% EPSS · 1 article