The Avada (Fusion) Builder WordPress plugin up to version 3.16.1 contains a vulnerability that allows unauthenticated attackers to access sensitive user information. This is due to improper exposure of user meta data via the 'args[link_target]' parameter. Attackers can retrieve administrator emails, login names, user levels, and WooCommerce customer personally identifiable information such as billing email, phone, and address. The required nonce to exploit this is publicly exposed on pages using the [fusion_instagram] shortcode, enabling anonymous harvesting.
The Avada Website Builder theme for WordPress and WooCommerce is vulnerable to a stored cross-site scripting (XSS) flaw in user profile social link fields. Authenticated users with Subscriber-level access or higher can inject malicious scripts into author pages via social contact-method fields. Exploitation requires a user to click the malicious social icon link, and the site setting 'Open Social Icons in a New Window' must be disabled. This vulnerability affects versions up to and including 7.16.1.
The Avada (Fusion) Builder WordPress plugin is vulnerable to an authorization bypass vulnerability in all versions up to and including 7.16.1. This flaw allows unauthenticated attackers to invoke arbitrary WordPress action hooks via a crafted form submission, potentially causing severe impacts such as permanent deletion of site content and denial of service. Exploitation requires a published Avada form with AJAX submission and a notification email template including specific placeholders. The vulnerability also allows a blind arbitrary read of user/post meta data, but this information is only delivered to the site owner and cannot be exfiltrated by the attacker. The CVSS score is 9.1, indicating critical severity.
CVE-2026-84925 is a reflected cross-site scripting (XSS) vulnerability in the Avada | Website Builder For WordPress & WooCommerce theme. It affects all versions up to and including 7.16.1. The vulnerability arises from improper input sanitization and output escaping of the 'lang' parameter, allowing unauthenticated attackers to inject arbitrary scripts. These scripts execute if a user is tricked into clicking a crafted link. The issue involves unsafe concatenation of the injected value into a URL within the post editor metabox without proper encoding.
The Avada (Fusion) Builder plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability via the 'size' shortcode attribute. This affects all versions up to and including 3.15.6. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises because WordPress's wp_kses_post filter does not sanitize the injected payload, which resides within a shortcode attribute string without HTML angle brackets.
CVE-2026-18431 is a critical vulnerability in the Avada WordPress theme and its Fusion Builder plugin that allows unauthenticated attackers to write arbitrary files to the server. This vulnerability exists in all versions of Avada up to and including 7.16 and Fusion Builder up to and including 3.16. Exploitation requires both components to be installed and active, along with certain administrator-authored content. Successful exploitation can lead to remote code execution and complete site compromise.
The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Module Title’ parameter in all versions up to, and including, 3.15.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Avada (Fusion) Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the maybe_delete_files function in all versions up to, and including, 3.15.3. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The attack requires a published Avada form configured to save entries to the database; an unauthenticated attacker submits a path-traversal payload via the wp_ajax_nopriv_fusion_form_submit_ajax handler while also controlling the fusion_privacy_expiration_interval and privacy_expiration_action fields to force an immediate 'delete' cleanup, causing the planted entry to be automatically processed by the Fusion_Form_DB_Privacy shutdown-hook routine without any administrator interaction.
CVE-2026-54193 is a high-severity path traversal vulnerability in ThemeFusion's Fusion Builder plugin, affecting versions up to and including 3.15.4. This flaw allows contributors with limited privileges to delete arbitrary files on the system, leading to potential denial of service. The vulnerability does not impact confidentiality or integrity but causes high availability impact. No official patch or remediation guidance is currently provided by the vendor.
Deserialization of Untrusted Data vulnerability in ThemeFusion Fusion Builder fusion-builder allows Object Injection.This issue affects Fusion Builder: from n/a through 3.15.3.
The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcodes in all versions up to, and including, 3.15.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user (typically an administrator) accesses a page displaying dynamic user data (such as via the Dynamic Data feature pulling user biographical information).
The Avada Builder (fusion-builder) plugin for WordPress is vulnerable to Unauthenticated Remote Code Execution via PHP Function Injection in versions up to and including 3.15.2. This is due to the `wp_conditional_tags` case in `Fusion_Builder_Conditional_Render_Helper::get_value()` passing attacker-controlled values from a base64-decoded JSON blob directly to `call_user_func()` without any allowlist validation. This is exploitable by unauthenticated attackers through the `fusion_get_widget_markup` AJAX endpoint, which is registered for non-privileged (unauthenticated) users via `wp_ajax_nopriv_fusion_get_widget_markup`. The endpoint is protected only by a nonce (`fusion_load_nonce`), but this nonce is generated for user ID 0 and is deterministically exposed in the JavaScript output of any public-facing page containing a Post Cards (`[fusion_post_cards]`) or Table of Contents (`[fusion_table_of_contents]`) element. This makes it possible for unauthenticated attackers to execute arbitrary code on affected sites.
The Avada Builder plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.15.2 via the 'fusion_get_svg_from_file' function with the 'custom_svg' parameter of the 'fusion_section_separator' shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The vulnerability was partially patched in version 3.15.2 and fully patched in version 3.15.3.
The Avada Builder plugin for WordPress is vulnerable to time-based SQL Injection via the ‘product_order’ parameter in all versions up to, and including, 3.15.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Note: The vulnerability can only be exploited if WooCommerce was previously used and then deactivated.
Cross-Site Request Forgery (CSRF) vulnerability in ThemeFusion Avada allows Cross Site Request Forgery.This issue affects Avada: from n/a before 7.13.2.