WordPress plugin
Avada (Fusion) Builder security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 33 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical4
- High8
- Medium21
- Low0
All Avada (Fusion) Builder vulnerabilities
- High7.2Unauthenticated Stored Cross-Site Scripting via Form Notification Dynamic-Data action_hook
≤3.16.1Update to 3.16.2
- Critical9.1Unauthenticated Arbitrary WordPress Action Invocation via '{action_hook}' Dynamic-Data Token in Form Field
≤3.16.1Update to 3.16.2
- Critical9.8Unauthenticated Remote Code Execution via Arbitrary File Write
≤3.16Update to 3.16.1
- Critical9.1Unauthenticated Arbitrary File Deletion via Form Entry Value
≤3.15.3Update to 3.15.4
- High8.8Authenticated (Contributor+) Privilege Escalation
≤3.15.4Update to 3.15.5
- High8.1Authenticated (Contributor+) Arbitrary File Deletion
≤3.15.4Update to 3.15.5
- High7.5Authenticated (Contributor+) PHP Object Injection
≤3.15.4Update to 3.15.5
- Critical9.8Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler
≤3.15.2Update to 3.15.3
- High7.5Unauthenticated SQL Injection via 'product_order' Parameter
≤3.15.1Update to 3.15.2
- High7.3Unauthenticated Arbitrary Shortcode Execution
≤3.11.13Update to 3.11.14
- High8.8Authenticated (Subscriber+) SQL Injection
≤3.11.1Update to 3.11.2
- High8.3Unauthenticated Server-Side Request Forgery
<3.6.2Update to 3.6.2
Avada (Fusion) Builder: common questions
Does Avada (Fusion) Builder have known vulnerabilities?
Yes. VulnCrest Radar lists 33 known vulnerabilities in Avada (Fusion) Builder: 4 critical, 8 high, 21 medium. None are known to affect version null.
How do I check which version of Avada (Fusion) Builder I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Avada (Fusion) Builder vulnerability?
CVE-2026-84938, published Nov 9, 2026: Avada (Fusion) Builder <= 3.16.1 - Unauthenticated Stored Cross-Site Scripting via Form Notification Dynamic-Data action_hook. Severity: High (CVSS 7.2).
Is any Avada (Fusion) Builder vulnerability listed in CISA KEV?
No. None of the known Avada (Fusion) Builder vulnerabilities is currently listed in the CISA KEV catalog.