ThemeFusion vulnerabilities
We track 16 vulnerabilities in ThemeFusion products across 4 products. 16 are rated high or critical, and none are known to be exploited. The most recent was published on November 10, 2026.
Latest ThemeFusion vulnerabilities
- 7.2 High severity
Avada (Fusion) Builder: Improper Neutralization of Input During Web Page Generation
The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Form Notification Dynamic-Data action_hook → Media Upload Chain (ID3 Metadata / html_attributes) in all versions up to, and including, 3.16.1 due to insufficient i
- 8.1 High severity
Avada | Website Builder For WordPress &…: Unrestricted Upload of File with Dangerous Type
The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 7.16.2 via the convert_palette_images_to_truecolor() function. This is due to insufficient file type validation
- 9.1 Critical severity
Avada (Fusion) Builder: Improper Control of Generation of Code
The Avada (Fusion) Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16.1. This is due to the plugin not properly verifying authorization before dispatching a WordPress action hook whose name is taken fr
- 9.8 Critical severity
Avada (Fusion) Builder: Missing Authorization
The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16. This is due to a chain of authorization and input vali
- 9.1 Critical severity
Avada (Fusion) Builder: Improper Limitation of a Pathname to a Restricted Directory
The Avada (Fusion) Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the maybe_delete_files function in all versions up to, and including, 3.15.3. This makes it possible for unauthenticated attack
- 8.8 High severity
Fusion Builder: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in ThemeFusion Fusion Builder fusion-builder allows Object Injection.This issue affects Fusion Builder: from n/a through 3.15.3.
- 9.8 Critical severity
Avada (Fusion) Builder: Improper Neutralization of Special Elements in Output Used by a Downstream Component
The Avada Builder (fusion-builder) plugin for WordPress is vulnerable to Unauthenticated Remote Code Execution via PHP Function Injection in versions up to and including 3.15.2. This is due to the `wp_conditional_tags` case in `Fusion_Builder_Conditional_Rende
- 7.5 High severity
Avada (Fusion) Builder: Improper Neutralization of Special Elements used in an SQL Command
The Avada Builder plugin for WordPress is vulnerable to time-based SQL Injection via the ‘product_order’ parameter in all versions up to, and including, 3.15.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th
- 7.1 High severity
Fusion Builder: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeFusion Fusion Builder fusion-builder allows Reflected XSS.This issue affects Fusion Builder: from n/a through < 3.15.0.
- 9.8 Critical severity
Avada | Website Builder For WordPress &…: Improper Control of Generation of Code
The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 7.11.13. This is due to the software allowing users to execute an action that does not properly val
- 9.8 Critical severity
Avada (Fusion) Builder: Improper Control of Generation of Code
The Avada Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.11.13. This is due to the software allowing users to execute an action that does not properly validate a value before running do_short
- 7.2 High severity
Avada | Website Builder For WordPress &…: Improper Neutralization of Special Elements used in an SQL Command
The Avada theme for WordPress is vulnerable to SQL Injection via the 'entry' parameter in all versions up to, and including, 7.11.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This m
- 8.8 High severity
Fusion Builder: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ThemeFusion Fusion Builder.This issue affects Fusion Builder: from n/a through 3.11.1.
- 7.1 High severity
Fusion Builder: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeFusion Fusion Builder allows Reflected XSS.This issue affects Fusion Builder: from n/a through 3.11.1.
- 8.8 High severity
Avada | Website Builder For WordPress &…: Unrestricted Upload of File with Dangerous Type
The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajax_import_options() function in all versions up to, and including, 7.11.4. This makes it possible f
- 8.8 High severity
Avada (premium WordPress theme): Cross-Site Request Forgery
Cross-Site Request Forgery (CSRF) vulnerability in ThemeFusion Avada premium theme versions <= 7.8.1 on WordPress leading to arbitrary plugin installation/activation.