Skip to main content

ThemeFusion Avada CVE-2025-58922

| EUVDEUVD-2025-209554 MEDIUM
Cross-Site Request Forgery (CSRF) (CWE-352)
2026-04-22 Patchstack GHSA-p24m-7r2j-27vw
CSRF Avada
4.3
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
4.3 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None

Lifecycle Timeline

6
Analysis Generated
Apr 23, 2026 - 00:17 vuln.today
Patch released
Apr 22, 2026 - 20:22 nvd
Patch available
Patch available
Apr 22, 2026 - 17:33 EUVD
EUVD ID Assigned
Apr 22, 2026 - 16:01 euvd
EUVD-2025-209554
Analysis Generated
Apr 22, 2026 - 16:01 vuln.today
CVE Published
Apr 22, 2026 - 15:44 nvd
MEDIUM 4.3

DescriptionCVE.org

Cross-Site Request Forgery (CSRF) vulnerability in ThemeFusion Avada allows Cross Site Request Forgery.This issue affects Avada: from n/a before 7.13.2.

AnalysisAI

Cross-Site Request Forgery (CSRF) vulnerability in ThemeFusion Avada theme allows unauthenticated remote attackers to perform unauthorized actions on behalf of authenticated users through malicious web pages, affecting versions before 7.13.2. The vulnerability requires user interaction (clicking a malicious link or visiting a crafted page) but carries low overall risk due to SSVC assessment indicating none-automatable exploitation with partial technical impact. No active exploitation has been confirmed in CISA KEV at time of analysis.

Technical ContextAI

This CSRF vulnerability (CWE-352) exists in the Avada WordPress theme, a comprehensive website builder that handles user actions through HTTP requests. The vulnerability stems from insufficient CSRF token validation or missing nonce verification on state-changing operations. WordPress themes are server-side PHP applications that process form submissions and AJAX requests; Avada likely fails to properly validate anti-CSRF tokens (WordPress nonces) on critical endpoints, allowing attackers to forge requests that execute with the privileges of any logged-in site administrator or user. The theme runs in the context of WordPress multisite and single-site installations, making any authenticated user a potential victim if an attacker crafts a malicious page they visit.

RemediationAI

Vendor-released patch: upgrade ThemeFusion Avada to version 7.13.2 or later immediately. Update the theme through the WordPress admin dashboard (Appearance → Themes → Update Avada) or via Patchstack's managed update service for automated patching. No workarounds are available for CSRF vulnerabilities without code modification; the patch must be applied to restore proper nonce validation. Site administrators should verify that the WordPress installation enforces nonce checking via the wp_verify_nonce() function in custom post handlers and AJAX endpoints, though Avada's core theme update resolves this issue directly. Detailed advisory available at Patchstack: https://patchstack.com/database/wordpress/theme/avada/vulnerability/wordpress-avada-theme-7-13-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve

More in Avada

View all
CVE-2024-2340 MEDIUM POC
5.3 Apr 09

The Avada theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.11
CVE-2022-1386 CRITICAL POC
9.8 May 16

The Fusion Builder WordPress plugin before 3.6.2, used in the Avada theme, does not validate a parameter in its forms wh
CVE-2024-13346 HIGH
7.3 Feb 13

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to arbitrary shortcode executi
CVE-2024-2344 HIGH POC
7.2 Apr 09

SQL injection in the Avada theme for WordPress (versions up to and including 7.11.6) allows authenticated attackers with
CVE-2024-2311 MEDIUM POC
6.4 Apr 09

The Avada theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions u
CVE-2024-2343 MEDIUM POC
6.4 Apr 09

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Server-Side Request Forgery
CVE-2020-36711 MEDIUM POC
6.4 Jun 07

The Avada theme for WordPress is vulnerable to Stored Cross-Site Scripting via the update_layout function in versions up
CVE-2024-1468 HIGH
8.8 Feb 29

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to arbitrary file uploads due

CVE-2026-12256 HIGH
8.8 Jun 16

PHP Object Injection in the ThemeFusion Avada WordPress theme versions 3.15.3 and earlier allows authenticated users wit
CVE-2022-41996 HIGH
8.8 Oct 27

Cross-Site Request Forgery (CSRF) vulnerability in ThemeFusion Avada premium theme versions <= 7.8.1 on WordPress leadin
CVE-2023-39307 HIGH
8.5 Mar 26

Unrestricted Upload of File with Dangerous Type vulnerability in ThemeFusion Avada.11.1. Rated high severity (CVSS 8.5),
CVE-2023-39313 HIGH
7.7 Mar 28

Server-Side Request Forgery (SSRF) vulnerability in ThemeFusion Avada.11.1. Rated high severity (CVSS 7.7), this vulnera

Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)

View all
CVE-2016-6277 HIGH POC
8.8
CVE-2014-100005 HIGH POC
8.0
CVE-2013-5696 MEDIUM POC
6.8
CVE-2020-36836 HIGH POC
8.0
CVE-2015-2295 MEDIUM POC
6.8
CVE-2016-6897 MEDIUM POC
6.5
CVE-2022-41622 HIGH POC
8.8
CVE-2025-2907 CRITICAL POC
9.8

Same technique CSRF

View all
CVE-2016-6277 HIGH POC
8.8
CVE-2014-100005 HIGH POC
8.0
CVE-2017-9757 HIGH POC
8.8
CVE-2013-5696 MEDIUM POC
6.8
CVE-2013-4152 MEDIUM POC
6.8
CVE-2024-7094 CRITICAL
9.8
CVE-2015-4624 HIGH POC
7.5
CVE-2020-36836 HIGH POC
8.0

Share

CVE-2025-58922 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy