Vulnerability archive

Understand vulnerabilities. Protect your applications.

Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.

Platform

Severity

Disclosed from

Disclosed to

Vulnerability archive 59

Reset filters

Medium 09.10.2026

CVE-2026-97340

Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Authenticated Stored Cross-Site Scripting

A vulnerability in the Avada theme for WordPress allows authenticated users to store malicious scripts in author profile social links. If clicked when links do not open in a new window, the script executes in the victim's browser.

Critical 09.10.2026

CVE-2026-97670

Avada (Fusion) Builder <= 7.16.1 - Unauthenticated Arbitrary WordPress Action Invocation via '{action_hook}' Dynamic-Data Token in Form Field

Medium 01.10.2026

CVE-2026-84925

Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Reflected Cross-Site Scripting via 'lang' Parameter

Medium 27.08.2026

CVE-2026-16654

Avada (Fusion) Builder <= 3.15.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' Shortcode Attribute

Critical 25.08.2026

CVE-2026-18431

Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write

Medium 23.07.2026

CVE-2026-65524

Avada Custom Branding <= 1.2 - Missing Authorization

Medium 22.07.2026

CVE-2026-65471

Avada Core <= 5.15.6 - Cross-Site Request Forgery

Medium 13.07.2026

CVE-2026-12536

Avada Builder <= 3.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Title

Critical 18.06.2026

CVE-2026-8713

Avada (Fusion) Builder <= 3.15.3 - Unauthenticated Arbitrary File Deletion via Form Entry Value

High 18.06.2026

CVE-2026-56008

Avada (Fusion) Builder <= 3.15.4 - Authenticated (Contributor+) Privilege Escalation

High 16.06.2026

CVE-2026-54193

Avada (Fusion) Builder <= 3.15.4 - Authenticated (Contributor+) Arbitrary File Deletion

High 15.06.2026

CVE-2026-54194

Avada (Fusion) Builder <= 3.15.4 - Authenticated (Contributor+) PHP Object Injection

High 15.06.2026

CVE-2026-12256

Avada <= 3.15.3 - Authenticated (Contributor+) PHP Object Injection

Medium 20.05.2026

CVE-2026-1543

Avada (Fusion) Builder <= 3.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Multiple Shortcodes

Critical 20.05.2026

CVE-2026-6279

Avada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler

High 12.05.2026

CVE-2026-4798

Avada Builder <= 3.15.1 - Unauthenticated SQL Injection via 'product_order' Parameter

Medium 12.05.2026

CVE-2026-4782

Avada Builder <= 3.15.2 - Authenticated (Subscriber+) Arbitrary File Read via 'custom_svg' Shortcode Parameter

Medium 22.04.2026

CVE-2025-58922

Avada < 7.13.2 - Cross-Site Request Forgery

Medium 14.04.2026

CVE-2026-1509

Avada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Limited Arbitrary WordPress Action Execution

Medium 14.04.2026

CVE-2026-1541

Avada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Sensitive Information Exposure via Insecure Direct Object Reference

Medium 20.03.2026

CVE-2026-32542

Avada (Fusion) Builder < 3.15.0 - Reflected Cross-Site Scripting

Medium 10.03.2026

CVE-2026-32453

Avada Core < 5.15.0 - Missing Authorization

Medium 10.03.2026

CVE-2026-32451

Avada (Fusion) Builder < 3.15.0 - Missing Authorization

Medium 10.03.2026

CVE-2026-32454

Avada Core < 5.15.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

Showing 1 to 24 of 59 results

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application

Understand vulnerabilities. Protect your applications.

Vulnerability archive 59

Know which vulnerabilities affect your application

Application security in your inbox