CVE Tools
Track your stack

Themefusion

6 CVEs tracked since 2024. Since Mar 2024, none of them reached CISA KEV.

Themefusion CVEs per month

Mar 2024 to Mar 2024. Point at a month, or focus the strip and use the arrow keys.
Themefusion CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2024-0360

Products

The products that kept showing up in Themefusion's monthly top three, with their CVEs summed over those months.

  1. Fusion Builder31 month
  2. Avada21 month
  3. Avada | Website Builder For WordPress & Woocommerce11 month

Latest CVEs

The 15 most recently published vulnerabilities affecting Themefusion.

  1. CVE-2026-16654Avada (Fusion) Builder <= 3.15.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' Shortcode Attribute6.4
  2. CVE-2026-18431Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write9.8
  3. CVE-2026-65524WordPress Avada Custom Branding plugin <= 1.2 - Broken Access Control vulnerability4.3
  4. CVE-2026-12536Avada Builder <= 3.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Title6.4
  5. CVE-2026-56008WordPress Fusion Builder plugin <= 3.15.4 - Privilege Escalation vulnerability8.8
  6. CVE-2026-8713Avada (Fusion) Builder <= 3.15.3 - Unauthenticated Arbitrary File Deletion via Form Entry Value9.1
  7. CVE-2026-54193WordPress Fusion Builder plugin <= 3.15.4 - Arbitrary File Deletion vulnerability7.7
  8. CVE-2026-12256WordPress Avada theme <= 3.15.3 - PHP Object Injection vulnerability8.8
  9. CVE-2026-54194WordPress Fusion Builder plugin <= 3.15.4 - PHP Object Injection vulnerability9.8
  10. CVE-2026-1543Avada (Fusion) Builder <= 3.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Multiple Shortcodes6.4
  11. CVE-2026-6279Avada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler9.8
  12. CVE-2026-4782Avada Builder <= 3.15.2 - Authenticated (Subscriber+) Arbitrary File Read via 'custom_svg' Shortcode Parameter6.5
  13. CVE-2026-4798Avada Builder <= 3.15.1 - Unauthenticated SQL Injection via 'product_order' Parameter7.5
  14. CVE-2025-58922WordPress Avada theme < 7.13.2 - Cross Site Request Forgery (CSRF) vulnerability4.3
  15. CVE-2026-1509Avada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Limited Arbitrary WordPress Action Execution5.4

The record

Peak rank
#142 in Mar 2024
Busiest month shown
Mar 2024, 6 CVEs
Months with a KEV entry
0 since Mar 2024
Monthly snapshots
1 since 2024
Themefusion's full record, month by month

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store