Avada Website Builder For Wordpress Woocommerce
Monthly
Arbitrary file upload in the Avada theme for WordPress and WooCommerce, versions up to and including 7.16.2, can lead to remote code execution because convert_palette_images_to_truecolor() processes uploaded files without sufficient file type validation. The issue has a CVSS score of 8.1 with AC:H, meaning an additional attacker-uncontrolled or configuration-dependent precondition must hold; the sources do not describe that trigger, so the prerequisite is unverified. No public exploit identified at time of analysis and no KEV status is present in the supplied data; the vendor has published a 7.16.4 security update, and vuln.today assigns this_week priority - a credible priority but not an all-hands emergency.
Unauthenticated arbitrary file write in the Avada WordPress theme (versions up to and including 7.16) combined with the Fusion Builder plugin (up to and including 3.16) lets remote attackers plant attacker-controlled files - including executable PHP - leading to remote code execution and full site takeover. The flaw is a cross-component chain of broken authorization and weak input validation (CWE-862) reported by Wordfence, and requires both components active plus specific administrator-authored content to be present. No public exploit is identified at time of analysis and it is not listed in CISA KEV.
Stored cross-site scripting in the Avada theme for WordPress (versions up to and including 7.16.1) allows authenticated attackers with Subscriber-level access or higher to inject javascript: URLs into author social link profile fields, which execute when a victim visits the attacker's author archive page and clicks the affected social icon. Exploitation is constrained by required user interaction and by the Avada option 'Open Social Icons in a New Window' being set to Off so the browser does not block the javascript: URL in a new tab. This is a moderate-severity issue (CVSS 6.4) that does not rise to emergency priority, and no public exploit was identified at time of analysis.
Reflected cross-site scripting in the Avada theme for WordPress (Website Builder For WordPress & WooCommerce) affects all versions up to and including 7.16.1, allowing an unauthenticated attacker to inject arbitrary script into the post-editor metabox by convincing a user who can access that editor to click a crafted link carrying a malicious 'lang' query parameter. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, base 6.1) confirms the attack is network-reachable without attacker credentials but requires victim interaction, and the changed scope (S:C) reflects that the injected script executes in the victim's browser session rather than compromising the server directly. No public exploit code was identified at time of analysis and there is no CISA KEV entry, so this should be treated as a medium-severity, social-engineering-dependent flaw rather than an actively exploited one. Assessed risk: this is a reflected Cross-Site Scripting flaw (CWE-79) with a CVSS 3.1 base score of 6.1 (Medium).
Arbitrary file upload in the Avada theme for WordPress and WooCommerce, versions up to and including 7.16.2, can lead to remote code execution because convert_palette_images_to_truecolor() processes uploaded files without sufficient file type validation. The issue has a CVSS score of 8.1 with AC:H, meaning an additional attacker-uncontrolled or configuration-dependent precondition must hold; the sources do not describe that trigger, so the prerequisite is unverified. No public exploit identified at time of analysis and no KEV status is present in the supplied data; the vendor has published a 7.16.4 security update, and vuln.today assigns this_week priority - a credible priority but not an all-hands emergency.
Unauthenticated arbitrary file write in the Avada WordPress theme (versions up to and including 7.16) combined with the Fusion Builder plugin (up to and including 3.16) lets remote attackers plant attacker-controlled files - including executable PHP - leading to remote code execution and full site takeover. The flaw is a cross-component chain of broken authorization and weak input validation (CWE-862) reported by Wordfence, and requires both components active plus specific administrator-authored content to be present. No public exploit is identified at time of analysis and it is not listed in CISA KEV.
Stored cross-site scripting in the Avada theme for WordPress (versions up to and including 7.16.1) allows authenticated attackers with Subscriber-level access or higher to inject javascript: URLs into author social link profile fields, which execute when a victim visits the attacker's author archive page and clicks the affected social icon. Exploitation is constrained by required user interaction and by the Avada option 'Open Social Icons in a New Window' being set to Off so the browser does not block the javascript: URL in a new tab. This is a moderate-severity issue (CVSS 6.4) that does not rise to emergency priority, and no public exploit was identified at time of analysis.
Reflected cross-site scripting in the Avada theme for WordPress (Website Builder For WordPress & WooCommerce) affects all versions up to and including 7.16.1, allowing an unauthenticated attacker to inject arbitrary script into the post-editor metabox by convincing a user who can access that editor to click a crafted link carrying a malicious 'lang' query parameter. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, base 6.1) confirms the attack is network-reachable without attacker credentials but requires victim interaction, and the changed scope (S:C) reflects that the injected script executes in the victim's browser session rather than compromising the server directly. No public exploit code was identified at time of analysis and there is no CISA KEV entry, so this should be treated as a medium-severity, social-engineering-dependent flaw rather than an actively exploited one. Assessed risk: this is a reflected Cross-Site Scripting flaw (CWE-79) with a CVSS 3.1 base score of 6.1 (Medium).