Avada Core
Monthly
Cross-Site Request Forgery in the Avada Core (fusion-core) WordPress plugin at versions 5.15.6 and earlier lets a remote attacker forge privileged state-changing requests by tricking an authenticated user into visiting a malicious page. The flaw (CWE-352) carries a vendor/Patchstack CVSS of 9.6 with a scope-changing, high-impact vector and requires victim interaction (UI:R) but no attacker authentication (PR:N). There is no public exploit identified at time of analysis and it is not listed in CISA KEV; no EPSS score was supplied.
A DOM-based Cross-Site Scripting (XSS) vulnerability exists in ThemeFusion Avada Core plugin versions prior to 5.15.0, allowing authenticated users with low privileges to inject malicious scripts that execute in other users' browsers. The vulnerability requires user interaction (UI:R) and affects the confidentiality, integrity, and availability of affected WordPress installations. With an EPSS score of 0.03% (8th percentile), real-world exploitation probability is currently low, though the vulnerability is documented and patched.
This is a missing authorization vulnerability in ThemeFusion Avada Core (versions prior to 5.15.0) that allows unauthenticated attackers to modify data through incorrectly configured access control security levels. The vulnerability has a CVSS score of 5.3 with network attack vector and no privilege requirements, meaning any remote attacker can exploit it without authentication. While the integrity impact is limited (data modification rather than disclosure or system compromise), the lack of authentication requirements and network accessibility make this a practical security concern for websites using vulnerable Avada versions.
Cross-Site Request Forgery in the Avada Core (fusion-core) WordPress plugin at versions 5.15.6 and earlier lets a remote attacker forge privileged state-changing requests by tricking an authenticated user into visiting a malicious page. The flaw (CWE-352) carries a vendor/Patchstack CVSS of 9.6 with a scope-changing, high-impact vector and requires victim interaction (UI:R) but no attacker authentication (PR:N). There is no public exploit identified at time of analysis and it is not listed in CISA KEV; no EPSS score was supplied.
A DOM-based Cross-Site Scripting (XSS) vulnerability exists in ThemeFusion Avada Core plugin versions prior to 5.15.0, allowing authenticated users with low privileges to inject malicious scripts that execute in other users' browsers. The vulnerability requires user interaction (UI:R) and affects the confidentiality, integrity, and availability of affected WordPress installations. With an EPSS score of 0.03% (8th percentile), real-world exploitation probability is currently low, though the vulnerability is documented and patched.
This is a missing authorization vulnerability in ThemeFusion Avada Core (versions prior to 5.15.0) that allows unauthenticated attackers to modify data through incorrectly configured access control security levels. The vulnerability has a CVSS score of 5.3 with network attack vector and no privilege requirements, meaning any remote attacker can exploit it without authentication. While the integrity impact is limited (data modification rather than disclosure or system compromise), the lack of authentication requirements and network accessibility make this a practical security concern for websites using vulnerable Avada versions.