Theme-fusion vulnerabilities
We track 6 vulnerabilities in Theme-fusion products across 2 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on February 13, 2025.
Latest Theme-fusion vulnerabilities
- 9.8 Critical severity
Avada | Website Builder For WordPress &…: Improper Control of Generation of Code
The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 7.11.13. This is due to the software allowing users to execute an action that does not properly val
- 9.8 Critical severity
Avada (Fusion) Builder: Improper Control of Generation of Code
The Avada Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.11.13. This is due to the software allowing users to execute an action that does not properly validate a value before running do_short
- 7.2 High severity
Avada | Website Builder For WordPress &…: Improper Neutralization of Special Elements used in an SQL Command
The Avada theme for WordPress is vulnerable to SQL Injection via the 'entry' parameter in all versions up to, and including, 7.11.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This m
- 8.8 High severity
Avada | Website Builder For WordPress &…: Unrestricted Upload of File with Dangerous Type
The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajax_import_options() function in all versions up to, and including, 7.11.4. This makes it possible f
- 8.8 High severity
Avada (premium WordPress theme): Cross-Site Request Forgery
Cross-Site Request Forgery (CSRF) vulnerability in ThemeFusion Avada premium theme versions <= 7.8.1 on WordPress leading to arbitrary plugin installation/activation.
- 9.8 Critical severity
Fusion Builder: Server-Side Request Forgery
The Fusion Builder WordPress plugin before 3.6.2, used in the Avada theme, does not validate a parameter in its forms which could be used to initiate arbitrary HTTP requests. The data returned is then reflected back in the application's response. This could be