16
CVEs
4
Critical
4
High
0
KEV
2
PoC
7
Unpatched C/H
12.5%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
4
HIGH
4
MEDIUM
8
LOW
0
Monthly CVE Trend
Affected Products (9)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-8713 | Arbitrary file deletion in the Avada (Fusion) Builder WordPress plugin through version 3.15.3 allows remote unauthenticated attackers to delete any file on the server via path traversal in the maybe_delete_files function, which commonly escalates to remote code execution when wp-config.php is removed and WordPress enters setup mode. Wordfence reports the flaw is reachable through the wp_ajax_nopriv_fusion_form_submit_ajax handler on sites that have a published Avada form saving entries to the database. No public exploit identified at time of analysis, but the CVSS 9.1 score reflects trivial network exploitation with no authentication or user interaction. | CRITICAL | 9.1 | 1.2% | 67 |
PoC
No patch
|
| CVE-2026-18431 | Unauthenticated arbitrary file write in the Avada WordPress theme (versions up to and including 7.16) combined with the Fusion Builder plugin (up to and including 3.16) lets remote attackers plant attacker-controlled files - including executable PHP - leading to remote code execution and full site takeover. The flaw is a cross-component chain of broken authorization and weak input validation (CWE-862) reported by Wordfence, and requires both components active plus specific administrator-authored content to be present. No public exploit is identified at time of analysis and it is not listed in CISA KEV. | CRITICAL | 9.8 | 0.6% | 50 |
PoC
No patch
|
| CVE-2026-6279 | Unauthenticated remote code execution in the Avada Builder (fusion-builder) WordPress plugin versions up to and including 3.15.2 allows attackers to execute arbitrary PHP on affected sites by abusing an unsanitized call_user_func() invocation reachable through a public AJAX endpoint. Wordfence-reported issue affects any WordPress site running the Avada theme stack that exposes a Post Cards or Table of Contents element on a public page, since the protecting nonce is deterministically leaked in the page's JavaScript. No public exploit identified at time of analysis, but the CVSS 9.8 rating and trivial precondition (visiting one page that emits the nonce) make this high-priority. | CRITICAL | 9.8 | 0.1% | 49 |
No patch
|
| CVE-2026-54194 | PHP Object Injection in the ThemeFusion Fusion Builder WordPress plugin (versions ≤ 3.15.4) allows authenticated users with Contributor-level access to inject crafted serialized PHP objects that are deserialized by the plugin. Successful exploitation can lead to property-oriented programming (POP) chain execution depending on classes loaded in the WordPress runtime, with potential outcomes ranging from arbitrary file operations to remote code execution. No public exploit identified at time of analysis and the issue is not on CISA KEV, but the Contributor prerequisite is low in many multi-author WordPress deployments. | CRITICAL | 9.8 | 0.5% | 49 |
No patch
|
| CVE-2026-12256 | PHP Object Injection in the ThemeFusion Avada WordPress theme versions 3.15.3 and earlier allows authenticated users with Contributor-level privileges to trigger unsafe deserialization, potentially leading to remote code execution, data tampering, or service disruption on the underlying WordPress installation. No public exploit identified at time of analysis, but the low attack complexity and widespread deployment of Avada as a commercial WordPress theme make this a meaningful risk for multi-author sites. | HIGH | 8.8 | 0.5% | 44 |
No patch
|
| CVE-2026-54193 | Arbitrary file deletion in the Fusion Builder WordPress plugin (versions <= 3.15.4) allows authenticated users with Contributor-level privileges to delete arbitrary files on the underlying server via a path traversal flaw. Deletion of critical files such as wp-config.php can force WordPress into setup mode, enabling site takeover; no public exploit identified at time of analysis, and the issue is not listed in CISA KEV. | HIGH | 7.7 | 0.3% | 38 |
No patch
|
| CVE-2026-4798 | Time-based SQL injection in Avada Builder for WordPress allows remote unauthenticated attackers to extract sensitive database information via the 'product_order' parameter. CVSS 7.5 (High) reflects network-accessible attack vector with no authentication required, but exploitation is limited to specific deployments where WooCommerce was previously installed then deactivated. No active exploitation confirmed (not in CISA KEV), but vulnerability disclosed by Wordfence Threat Intelligence with technical details publicly available. | HIGH | 7.5 | 0.1% | 38 |
No patch
|
| CVE-2026-32542 | A Reflected Cross-Site Scripting (XSS) vulnerability exists in ThemeFusion Fusion Builder, a WordPress page builder plugin, affecting all versions prior to 3.15.0. An unauthenticated attacker can inject malicious JavaScript into web pages through improper input sanitization, allowing them to steal session cookies, perform actions on behalf of users, or redirect visitors to malicious sites. No CVSS score, EPSS data, or public proof-of-concept have been officially published, but the vulnerability has been documented by Patchstack and assigned EUVD-2026-15919; patch availability is confirmed via the vendor advisory. | HIGH | 7.1 | 0.0% | 36 |
|
| CVE-2026-4782 | Arbitrary file read in Avada Builder plugin for WordPress versions up to 3.15.2 allows authenticated attackers with Subscriber-level access to read arbitrary files on the server via the 'fusion_get_svg_from_file' function in the 'fusion_section_separator' shortcode. Sensitive information including configuration files, database credentials, and private keys can be exposed. The vulnerability was partially patched in 3.15.2 and fully patched in version 3.15.3. | MEDIUM | 6.5 | 0.0% | 33 |
No patch
|
| CVE-2026-16654 | Stored Cross-Site Scripting in the Avada (Fusion) Builder WordPress plugin through version 3.15.6 allows authenticated contributors to permanently embed malicious JavaScript in page content via the 'size' shortcode attribute. The root bypass is structural: WordPress's wp_kses_post filter only inspects HTML angle-bracket constructs, so payloads confined entirely to a shortcode attribute string pass the filter unchanged at save time and execute in any visitor's browser. No public exploit code or CISA KEV listing is confirmed at time of analysis, though the Scope:Changed CVSS designation reflects that successful injection escalates attacker influence from the contributor's own context into the browsers of higher-privileged users, including site administrators. | MEDIUM | 6.4 | 0.2% | 32 |
No patch
|
| CVE-2026-1543 | Stored Cross-Site Scripting in Avada (Fusion) Builder for WordPress (all versions through 3.15.2) allows authenticated attackers with Subscriber-level access to persist malicious JavaScript via unsanitized shortcode parameters. The injected scripts execute in the browser of any user - typically an administrator - who views a page rendering dynamic user data such as biographical information sourced through the plugin's Dynamic Data feature. With CVSS Scope set to Changed (S:C), successful exploitation crosses the victim's security boundary, enabling session hijacking or privilege escalation against higher-privileged users. No public exploit code or CISA KEV listing has been identified at time of analysis. | MEDIUM | 6.4 | 0.0% | 32 |
No patch
|
| CVE-2026-12536 | Stored Cross-Site Scripting in the Avada (Fusion) Builder WordPress plugin versions up to 3.15.5 allows authenticated contributors to inject persistent malicious scripts via the 'Module Title' parameter, executing in the browsers of any user who views the affected page. This grants attackers the ability to steal session tokens, perform unauthorized actions on behalf of victims, or redirect users to malicious sites. No public exploit or CISA KEV listing has been identified at time of analysis, though the Contributor-level entry bar makes this accessible to a broad attacker pool on sites with open registration. | MEDIUM | 6.4 | 0.2% | 32 |
No patch
|
| CVE-2026-1509 | Arbitrary WordPress action execution in Avada (Fusion) Builder plugin versions up to 3.15.1 allows authenticated attackers with Subscriber-level access to invoke unvalidated WordPress action hooks via the Dynamic Data feature, potentially enabling privilege escalation, file inclusion, denial of service, or remote code execution depending on available hooks in the WordPress installation. The vulnerability stems from the `output_action_hook()` function accepting user-controlled input without authorization checks. No public exploit code or active exploitation has been confirmed at time of analysis. | MEDIUM | 5.4 | 0.0% | 27 |
No patch
|
| CVE-2026-1541 | Avada (Fusion) Builder plugin for WordPress up to version 3.15.1 allows authenticated Subscriber-level users and above to access protected post metadata through the Dynamic Data feature's `post_custom_field` parameter due to insufficient validation of underscore-prefixed metadata keys. The `fusion_get_post_custom_field()` function fails to enforce metadata access controls, enabling disclosure of sensitive metadata that should be restricted. No public exploit code or active exploitation has been confirmed at the time of analysis. | MEDIUM | 4.3 | 0.0% | 22 |
No patch
|
| CVE-2025-58922 | Cross-Site Request Forgery (CSRF) vulnerability in ThemeFusion Avada theme allows unauthenticated remote attackers to perform unauthorized actions on behalf of authenticated users through malicious web pages, affecting versions before 7.13.2. The vulnerability requires user interaction (clicking a malicious link or visiting a crafted page) but carries low overall risk due to SSVC assessment indicating none-automatable exploitation with partial technical impact. No active exploitation has been confirmed in CISA KEV at time of analysis. | MEDIUM | 4.3 | 0.0% | 22 |
|