Avada | Website Builder For WordPress & WooCommerce vulnerabilities
5 known vulnerabilities in Avada | Website Builder For WordPress & WooCommerce from ThemeFusion. 5 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.1 High severity
Avada | Website Builder For WordPress &…: Unrestricted Upload of File with Dangerous Type
The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 7.16.2 via the convert_palette_images_to_truecolor() function. This is due to insufficient file type validation
- 9.8 Critical severity
Avada (Fusion) Builder: Missing Authorization
The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16. This is due to a chain of authorization and input vali
- 9.8 Critical severity
Avada | Website Builder For WordPress &…: Improper Control of Generation of Code
The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 7.11.13. This is due to the software allowing users to execute an action that does not properly val
- 7.2 High severity
Avada | Website Builder For WordPress &…: Improper Neutralization of Special Elements used in an SQL Command
The Avada theme for WordPress is vulnerable to SQL Injection via the 'entry' parameter in all versions up to, and including, 7.11.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This m
- 8.8 High severity
Avada | Website Builder For WordPress &…: Unrestricted Upload of File with Dangerous Type
The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajax_import_options() function in all versions up to, and including, 7.11.4. This makes it possible f