Poznaj podatności. Chroń swoje aplikacje.

Średnia 09.10.2026

CVE-2026-97340

Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Uwierzytelnione wstrzykiwanie skryptów (Stored XSS)

Podatność w motywie Avada dla WordPressa pozwala uwierzytelnionym użytkownikom zapisać złośliwy skrypt w profilowych linkach społecznościowych, który wykona się w przeglądarce po kliknięciu ikony.

WordPress

avada

Krytyczna 09.10.2026

CVE-2026-97670

Avada (Fusion) Builder <= 7.16.1 - Unauthenticated Arbitrary WordPress Action Invocation via '{action_hook}' Dynamic-Data Token in Form Field

WordPress

fusion-builder

Średnia 01.10.2026

CVE-2026-84925

Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Reflected Cross-Site Scripting via 'lang' Parameter

WordPress

avada

Średnia 27.08.2026

CVE-2026-16654

Avada (Fusion) Builder <= 3.15.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' Shortcode Attribute

WordPress

fusion-builder

Krytyczna 25.08.2026

CVE-2026-18431

Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write

WordPress

fusion-builder, avada

Średnia 23.07.2026

CVE-2026-65524

Avada Custom Branding <= 1.2 - Missing Authorization

WordPress

fusion-white-label-branding

Średnia 22.07.2026

CVE-2026-65471

Avada Core <= 5.15.6 - Cross-Site Request Forgery

WordPress

fusion-core

Średnia 13.07.2026

CVE-2026-12536

Avada Builder <= 3.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Title

WordPress

fusion-builder

Krytyczna 18.06.2026

CVE-2026-8713

Avada (Fusion) Builder <= 3.15.3 - Unauthenticated Arbitrary File Deletion via Form Entry Value

WordPress

fusion-builder

Wysoka 18.06.2026

CVE-2026-56008

Avada (Fusion) Builder <= 3.15.4 - Authenticated (Contributor+) Privilege Escalation

WordPress

fusion-builder

Wysoka 16.06.2026

CVE-2026-54193

Avada (Fusion) Builder <= 3.15.4 - Authenticated (Contributor+) Arbitrary File Deletion

WordPress

fusion-builder

Wysoka 15.06.2026

CVE-2026-54194

Avada (Fusion) Builder <= 3.15.4 - Authenticated (Contributor+) PHP Object Injection

WordPress

fusion-builder

Wysoka 15.06.2026

CVE-2026-12256

Avada <= 3.15.3 - Authenticated (Contributor+) PHP Object Injection

WordPress

avada

Średnia 20.05.2026

CVE-2026-1543

Avada (Fusion) Builder <= 3.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Multiple Shortcodes

WordPress

fusion-builder

Krytyczna 20.05.2026

CVE-2026-6279

Avada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler

WordPress

fusion-builder

Wysoka 12.05.2026

CVE-2026-4798

Avada Builder <= 3.15.1 - Unauthenticated SQL Injection via 'product_order' Parameter

WordPress

fusion-builder

Średnia 12.05.2026

CVE-2026-4782

Avada Builder <= 3.15.2 - Authenticated (Subscriber+) Arbitrary File Read via 'custom_svg' Shortcode Parameter

WordPress

fusion-builder

Średnia 22.04.2026

CVE-2025-58922

Avada < 7.13.2 - Cross-Site Request Forgery

WordPress

avada

Średnia 14.04.2026

CVE-2026-1509

Avada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Limited Arbitrary WordPress Action Execution

WordPress

fusion-builder

Średnia 14.04.2026

CVE-2026-1541

Avada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Sensitive Information Exposure via Insecure Direct Object Reference

WordPress

fusion-builder

Średnia 20.03.2026

CVE-2026-32542

Avada (Fusion) Builder < 3.15.0 - Reflected Cross-Site Scripting

WordPress

fusion-builder

Średnia 10.03.2026

CVE-2026-32453

Avada Core < 5.15.0 - Missing Authorization

WordPress

fusion-core

Średnia 10.03.2026

CVE-2026-32451

Avada (Fusion) Builder < 3.15.0 - Missing Authorization

WordPress

fusion-builder

Średnia 10.03.2026

CVE-2026-32454

Avada Core < 5.15.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

WordPress

fusion-core