2
CVEs
1
Critical
0
High
0
KEV
1
PoC
1
Unpatched C/H
0.0%
Patch Rate
0.4%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
0
MEDIUM
1
LOW
0
Monthly CVE Trend
Affected Products (9)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-18431 | Unauthenticated arbitrary file write in the Avada WordPress theme (versions up to and including 7.16) combined with the Fusion Builder plugin (up to and including 3.16) lets remote attackers plant attacker-controlled files - including executable PHP - leading to remote code execution and full site takeover. The flaw is a cross-component chain of broken authorization and weak input validation (CWE-862) reported by Wordfence, and requires both components active plus specific administrator-authored content to be present. No public exploit is identified at time of analysis and it is not listed in CISA KEV. | CRITICAL | 9.8 | 0.6% | 50 |
PoC
No patch
|
| CVE-2026-16654 | Stored Cross-Site Scripting in the Avada (Fusion) Builder WordPress plugin through version 3.15.6 allows authenticated contributors to permanently embed malicious JavaScript in page content via the 'size' shortcode attribute. The root bypass is structural: WordPress's wp_kses_post filter only inspects HTML angle-bracket constructs, so payloads confined entirely to a shortcode attribute string pass the filter unchanged at save time and execute in any visitor's browser. No public exploit code or CISA KEV listing is confirmed at time of analysis, though the Scope:Changed CVSS designation reflects that successful injection escalates attacker influence from the contributor's own context into the browsers of higher-privileged users, including site administrators. | MEDIUM | 6.4 | 0.2% | 32 |
No patch
|