Schwachstellen verstehen. Anwendungen schützen.

Mittel 09.10.2026

CVE-2026-97340

Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Authentifiziertes gespeichertes Cross-Site Scripting

Eine Sicherheitslücke im Avada-Theme für WordPress ermöglicht es authentifizierten Benutzern, bösartige Skripte in Profil-Social-Links zu speichern. Bei einem Klick können diese Skripte im Browser des Besuchers ausgeführt werden.

WordPress

avada

Kritisch 09.10.2026

CVE-2026-97670

Avada (Fusion) Builder <= 7.16.1 - Unauthenticated Arbitrary WordPress Action Invocation via '{action_hook}' Dynamic-Data Token in Form Field

WordPress

fusion-builder

Mittel 01.10.2026

CVE-2026-84925

Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Reflected Cross-Site Scripting via 'lang' Parameter

WordPress

avada

Mittel 27.08.2026

CVE-2026-16654

Avada (Fusion) Builder <= 3.15.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' Shortcode Attribute

WordPress

fusion-builder

Kritisch 25.08.2026

CVE-2026-18431

Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write

WordPress

fusion-builder, avada

Mittel 23.07.2026

CVE-2026-65524

Avada Custom Branding <= 1.2 - Missing Authorization

WordPress

fusion-white-label-branding

Mittel 22.07.2026

CVE-2026-65471

Avada Core <= 5.15.6 - Cross-Site Request Forgery

WordPress

fusion-core

Mittel 13.07.2026

CVE-2026-12536

Avada Builder <= 3.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Title

WordPress

fusion-builder

Kritisch 18.06.2026

CVE-2026-8713

Avada (Fusion) Builder <= 3.15.3 - Unauthenticated Arbitrary File Deletion via Form Entry Value

WordPress

fusion-builder

Hoch 18.06.2026

CVE-2026-56008

Avada (Fusion) Builder <= 3.15.4 - Authenticated (Contributor+) Privilege Escalation

WordPress

fusion-builder

Hoch 16.06.2026

CVE-2026-54193

Avada (Fusion) Builder <= 3.15.4 - Authenticated (Contributor+) Arbitrary File Deletion

WordPress

fusion-builder

Hoch 15.06.2026

CVE-2026-54194

Avada (Fusion) Builder <= 3.15.4 - Authenticated (Contributor+) PHP Object Injection

WordPress

fusion-builder

Hoch 15.06.2026

CVE-2026-12256

Avada <= 3.15.3 - Authenticated (Contributor+) PHP Object Injection

WordPress

avada

Mittel 20.05.2026

CVE-2026-1543

Avada (Fusion) Builder <= 3.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Multiple Shortcodes

WordPress

fusion-builder

Kritisch 20.05.2026

CVE-2026-6279

Avada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler

WordPress

fusion-builder

Hoch 12.05.2026

CVE-2026-4798

Avada Builder <= 3.15.1 - Unauthenticated SQL Injection via 'product_order' Parameter

WordPress

fusion-builder

Mittel 12.05.2026

CVE-2026-4782

Avada Builder <= 3.15.2 - Authenticated (Subscriber+) Arbitrary File Read via 'custom_svg' Shortcode Parameter

WordPress

fusion-builder

Mittel 22.04.2026

CVE-2025-58922

Avada < 7.13.2 - Cross-Site Request Forgery

WordPress

avada

Mittel 14.04.2026

CVE-2026-1509

Avada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Limited Arbitrary WordPress Action Execution

WordPress

fusion-builder

Mittel 14.04.2026

CVE-2026-1541

Avada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Sensitive Information Exposure via Insecure Direct Object Reference

WordPress

fusion-builder

Mittel 20.03.2026

CVE-2026-32542

Avada (Fusion) Builder < 3.15.0 - Reflected Cross-Site Scripting

WordPress

fusion-builder

Mittel 10.03.2026

CVE-2026-32453

Avada Core < 5.15.0 - Missing Authorization

WordPress

fusion-core

Mittel 10.03.2026

CVE-2026-32451

Avada (Fusion) Builder < 3.15.0 - Missing Authorization

WordPress

fusion-builder

Mittel 10.03.2026

CVE-2026-32454

Avada Core < 5.15.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

WordPress

fusion-core