Extension WordPress

Vulnérabilités Avada (Fusion) Builder

Cette page rassemble les failles publiées pour Avada (Fusion) Builder, leurs plages de versions affectées et les correctifs signalés dans la base locale.

27Vulnérabilités
2Critiques
27Avec correctif
9,8CVSS maximal

Historique de sécurité

CVE et vulnérabilités de Avada (Fusion) Builder

27 fiches

CVE-2026-12536 Moyenne · 6,4
Avada (Fusion) Builder

Avada Builder <= 3.15.5 – Authenticated (Contributor+) Stored Cross-Site Scripting via Module Title

The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Module Title’ parameter in all versions up to, and including, 3.15.5 due to insufficient input sanitization and output escaping. This makes it possible…

Versions affectées

*-3.15.5

Correctif

3.15.6

Publication

13/07/2026

CVE-2026-8713 Critique · 9,1
Avada (Fusion) Builder

Avada (Fusion) Builder <= 3.15.3 – Unauthenticated Arbitrary File Deletion via Form Entry Value

The Avada (Fusion) Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the maybe_delete_files function in all versions up to, and including, 3.15.3. This makes it possible for unauthenticated attackers…

Versions affectées

*-3.15.3

Correctif

3.15.4

Publication

18/06/2026

CVE-2026-56008 Élevée · 8,8
Avada (Fusion) Builder

Avada (Fusion) Builder <= 3.15.4 – Authenticated (Contributor+) Privilege Escalation

The Avada (Fusion) Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.15.4. This makes it possible for authenticated attackers, with Contributor-level access and above, to elevate their privileges to that…

Versions affectées

*-3.15.4

Correctif

3.15.5

Publication

18/06/2026

CVE-2026-54193 Élevée · 8,1
Avada (Fusion) Builder

Avada (Fusion) Builder <= 3.15.4 – Authenticated (Contributor+) Arbitrary File Deletion

The Avada (Fusion) Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in all versions up to, and including, 3.15.4. This makes it possible for authenticated attackers, with Contributor-level access and…

Versions affectées

*-3.15.4

Correctif

3.15.5

Publication

16/06/2026

CVE-2026-54194 Élevée · 7,5
Avada (Fusion) Builder

Avada (Fusion) Builder <= 3.15.4 – Authenticated (Contributor+) PHP Object Injection

The Avada (Fusion) Builder plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 3.15.4 via deserialization of untrusted input. This makes it possible for authenticated attackers, with contributor-level access and above, to…

Versions affectées

*-3.15.4

Correctif

3.15.5

Publication

15/06/2026

CVE-2026-1543 Moyenne · 6,4
Avada (Fusion) Builder

Avada (Fusion) Builder <= 3.15.2 – Authenticated (Subscriber+) Stored Cross-Site Scripting via Multiple Shortcodes

The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcodes in all versions up to, and including, 3.15.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated…

Versions affectées

*-3.15.2

Correctif

3.15.3

Publication

20/05/2026

CVE-2026-6279 Critique · 9,8
Avada (Fusion) Builder

Avada (Fusion) Builder <= 3.15.2 – Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler

The Avada Builder (fusion-builder) plugin for WordPress is vulnerable to Unauthenticated Remote Code Execution via PHP Function Injection in versions up to and including 3.15.2. This is due to the `wp_conditional_tags` case in `Fusion_Builder_Conditional_Render_Helper::get_value()` passing attacker-controlled values from…

Versions affectées

*-3.15.2

Correctif

3.15.3

Publication

20/05/2026

CVE-2026-4782 Moyenne · 6,5
Avada (Fusion) Builder

Avada Builder <= 3.15.2 – Authenticated (Subscriber+) Arbitrary File Read via 'custom_svg' Shortcode Parameter

The Avada Builder plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.15.2 via the 'fusion_get_svg_from_file' function with the 'custom_svg' parameter of the 'fusion_section_separator' shortcode. This makes it possible for authenticated…

Versions affectées

*-3.15.2

Correctif

3.15.3

Publication

12/05/2026

CVE-2026-1509 Moyenne · 5,4
Avada (Fusion) Builder

Avada (Fusion) Builder <= 3.15.1 – Authenticated (Subscriber+) Limited Arbitrary WordPress Action Execution

The Avada (Fusion) Builder plugin for WordPress is vulnerable to Arbitrary WordPress Action Execution in all versions up to, and including, 3.15.1. This is due to the plugin's `output_action_hook()` function accepting user-controlled input to trigger any registered WordPress…

Versions affectées

*-3.15.1

Correctif

3.15.2

Publication

14/04/2026

CVE-2026-1541 Moyenne · 4,3
Avada (Fusion) Builder

Avada (Fusion) Builder <= 3.15.1 – Authenticated (Subscriber+) Sensitive Information Exposure via Insecure Direct Object Reference

The Avada (Fusion) Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.15.1. This is due to the plugin's `fusion_get_post_custom_field()` function failing to validate whether metadata keys are protected (underscore-prefixed).…

Versions affectées

*-3.15.1

Correctif

3.15.2

Publication

14/04/2026

CVE-2026-25472 Moyenne · 6,4
Avada (Fusion) Builder

Avada (Fusion) Builder <= 3.14.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.14.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access…

Versions affectées

*-3.14.1

Correctif

3.14.2

Publication

15/01/2026

CVE-2025-49940 Moyenne · 6,4
Avada (Fusion) Builder

Fusion Builder <= 3.13.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

The Fusion Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.13.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and…

Versions affectées

*-3.13.2

Correctif

3.13.3

Publication

03/10/2025

CVE-2025-6747 Moyenne · 6,4
Avada (Fusion) Builder

Avada (Fusion) Builder <= 3.12.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fusion_map' shortcode in all versions up to, and including, 3.12.1 due to insufficient input sanitization and output escaping on user supplied attributes.…

Versions affectées

*-3.12.1

Correctif

3.12.2

Publication

15/07/2025

CVE-2024-12477 Moyenne · 6,4
Avada (Fusion) Builder

Avada Builder <= 3.11.11 – Authenticated (Contributor+) Stored Cross-Site Scripting in Multiple Widgets

The Avada Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 3.11.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes…

Versions affectées

*-3.11.11

Correctif

3.11.12

Publication

22/01/2025

WP Commander

Rechercher dans toute la base WordPress

Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.

Ouvrir le tableau des vulnérabilités