Avada vulnerabilities
5 known vulnerabilities in Avada from Theme-fusion. 5 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.8 Critical severity
Avada | Website Builder For WordPress &…: Improper Control of Generation of Code
The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 7.11.13. This is due to the software allowing users to execute an action that does not properly val
- 7.2 High severity
Avada | Website Builder For WordPress &…: Improper Neutralization of Special Elements used in an SQL Command
The Avada theme for WordPress is vulnerable to SQL Injection via the 'entry' parameter in all versions up to, and including, 7.11.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This m
- 8.8 High severity
Avada | Website Builder For WordPress &…: Unrestricted Upload of File with Dangerous Type
The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajax_import_options() function in all versions up to, and including, 7.11.4. This makes it possible f
- 8.8 High severity
Avada (premium WordPress theme): Cross-Site Request Forgery
Cross-Site Request Forgery (CSRF) vulnerability in ThemeFusion Avada premium theme versions <= 7.8.1 on WordPress leading to arbitrary plugin installation/activation.
- 9.8 Critical severity
Fusion Builder: Server-Side Request Forgery
The Fusion Builder WordPress plugin before 3.6.2, used in the Avada theme, does not validate a parameter in its forms which could be used to initiate arbitrary HTTP requests. The data returned is then reflected back in the application's response. This could be