VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

Avada (Fusion) Builder security & vulnerabilities

fusion-builder— active installsLast vulnerability Nov 9, 2026

No known unpatched vulnerabilities in the latest version

All 33 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin
33Known vulnerabilities
  • Critical4
  • High8
  • Medium21
  • Low0
Vulnerabilities per year
2022: 1 vulnerability1222023: 4 vulnerabilities4232024: 2 vulnerabilities2242025: 5 vulnerabilities5252026: 21 vulnerabilities2126

All Avada (Fusion) Builder vulnerabilities

Avada (Fusion) Builder vulnerabilities
SeverityVulnerabilityCVEPublished
High7.2Unauthenticated Stored Cross-Site Scripting via Form Notification Dynamic-Data action_hook
≤3.16.1Update to 3.16.2
CVE-2026-84938
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'tab_index' and 'empty_notice' Shortcode Attributes
≤3.16.2Update to 3.16.3
CVE-2026-104729
Medium5.3Unauthenticated Sensitive Information Exposure in 'args[link_target]' Parameter via {user_meta} Dynamic Data Token
≤3.16.1Update to 3.16.2
CVE-2026-97471
Critical9.1 Unauthenticated Arbitrary WordPress Action Invocation via '{action_hook}' Dynamic-Data Token in Form Field
≤3.16.1Update to 3.16.2
CVE-2026-97670
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' Shortcode Attribute
≤3.15.6Update to 3.16
CVE-2026-16654
Critical9.8Unauthenticated Remote Code Execution via Arbitrary File Write
≤3.16Update to 3.16.1
CVE-2026-18431
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Module Title
≤3.15.5Update to 3.15.6
CVE-2026-12536
Critical9.1Unauthenticated Arbitrary File Deletion via Form Entry Value
≤3.15.3Update to 3.15.4
CVE-2026-8713
High8.8Authenticated (Contributor+) Privilege Escalation
≤3.15.4Update to 3.15.5
CVE-2026-56008
High8.1Authenticated (Contributor+) Arbitrary File Deletion
≤3.15.4Update to 3.15.5
CVE-2026-54193
High7.5Authenticated (Contributor+) PHP Object Injection
≤3.15.4Update to 3.15.5
CVE-2026-54194
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Multiple Shortcodes
≤3.15.2Update to 3.15.3
CVE-2026-1543
Critical9.8Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler
≤3.15.2Update to 3.15.3
CVE-2026-6279
High7.5Unauthenticated SQL Injection via 'product_order' Parameter
≤3.15.1Update to 3.15.2
CVE-2026-4798
Medium6.5Authenticated (Subscriber+) Arbitrary File Read via 'custom_svg' Shortcode Parameter
≤3.15.2Update to 3.15.3
CVE-2026-4782
Medium5.4Authenticated (Subscriber+) Limited Arbitrary WordPress Action Execution
≤3.15.1Update to 3.15.2
CVE-2026-1509
Medium4.3Authenticated (Subscriber+) Sensitive Information Exposure via Insecure Direct Object Reference
≤3.15.1Update to 3.15.2
CVE-2026-1541
Medium6.1Reflected Cross-Site Scripting
<3.15.0Update to 3.15.0
CVE-2026-32542
Medium4.3Missing Authorization
<3.15.0Update to 3.15.0
CVE-2026-32451
Medium5.3Missing Authorization
<3.15.0Update to 3.15.0
CVE-2026-32452
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.14.1Update to 3.14.2
CVE-2026-25472
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.13.2Update to 3.13.3
CVE-2025-49940
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
≤3.12.1Update to 3.12.2
CVE-2025-6747
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.11.14Update to 3.11.15
CVE-2025-1665
High7.3Unauthenticated Arbitrary Shortcode Execution
≤3.11.13Update to 3.11.14
CVE-2024-13345
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting in Multiple Widgets
≤3.11.11Update to 3.11.12
CVE-2024-12477
Medium4.3Authenticated (Contributor+) Protected Post Disclosure
≤3.11.12Update to 3.11.13
CVE-2024-12335
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via fusion_button Shortcode
≤3.11.9Update to 3.11.10
CVE-2024-5628
Medium6.5Cross-Site Request Forgery
≤3.11.1Update to 3.11.2
CVE-2023-39311
Medium6.1Reflected Cross-Site Scripting via User Register Element
≤3.11.1Update to 3.11.2
CVE-2023-39306
Medium4.3Missing Authorization
≤3.11.1Update to 3.11.2
CVE-2023-39310
High8.8Authenticated (Subscriber+) SQL Injection
≤3.11.1Update to 3.11.2
CVE-2023-39309
High8.3Unauthenticated Server-Side Request Forgery
<3.6.2Update to 3.6.2
CVE-2022-1386

Avada (Fusion) Builder: common questions

Does Avada (Fusion) Builder have known vulnerabilities?

Yes. VulnCrest Radar lists 33 known vulnerabilities in Avada (Fusion) Builder: 4 critical, 8 high, 21 medium. None are known to affect version null.

How do I check which version of Avada (Fusion) Builder I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent Avada (Fusion) Builder vulnerability?

CVE-2026-84938, published Nov 9, 2026: Avada (Fusion) Builder <= 3.16.1 - Unauthenticated Stored Cross-Site Scripting via Form Notification Dynamic-Data action_hook. Severity: High (CVSS 7.2).

Is any Avada (Fusion) Builder vulnerability listed in CISA KEV?

No. None of the known Avada (Fusion) Builder vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?