Vulnerabilidades en ThemeFusion
55 resultadosCVE-2026-12256HIGHWordPress Fusion Builder plugin <= 3.15.3 - PHP Object Injection vulnerabilityEPSS 0.5%CVE-2023-39310MEDIUMWordPress Avada Builder plugin <= 3.11.1 - Authenticated Broken Access Control vulnerabilityEPSS 0.5%CVE-2026-97670CRITICALAvada (Fusion) Builder <= 7.16.1 - Unauthenticated Arbitrary WordPress Action Invocation via '{action_hook}' Dynamic-Data Token in Form FieldEPSS 0.5%CVE-2026-56008HIGHWordPress Fusion Builder plugin <= 3.15.4 - Privilege Escalation vulnerabilityEPSS 0.4%CVE-2023-39306HIGHWordPress Avada Builder plugin <= 3.11.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-12335MEDIUMAvada Builder <= 3.11.12 - Authenticated (Contributor+) Protected Post DisclosureEPSS 0.4%CVE-2026-54194CRITICALWordPress Fusion Builder plugin <= 3.15.4 - PHP Object Injection vulnerabilityEPSS 0.4%CVE-2023-39922MEDIUMWordPress Avada theme <= 7.11.1 - Authenticated Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-1543MEDIUMAvada (Fusion) Builder <= 3.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Multiple ShortcodesEPSS 0.3%CVE-2026-54193HIGHWordPress Fusion Builder plugin <= 3.15.4 - Arbitrary File Deletion vulnerabilityEPSS 0.3%CVE-2024-5628MEDIUMAvada | Website Builder For WordPress & eCommerce <= 3.11.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via fusion_button ShortcodeEPSS 0.3%CVE-2026-1509MEDIUMAvada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Limited Arbitrary WordPress Action ExecutionEPSS 0.3%CVE-2025-1665MEDIUMAvada Builder <= 3.11.14 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-97471MEDIUMAvada (Fusion) Builder <= 3.16.1 - Unauthenticated Sensitive Information Exposure in 'args[link_target]' Parameter via {user_meta} Dynamic Data TokenEPSS 0.3%CVE-2026-1541MEDIUMAvada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Sensitive Information Exposure via Insecure Direct Object ReferenceEPSS 0.3%CVE-2026-65524MEDIUMWordPress Avada Custom Branding plugin <= 1.2 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-24748MEDIUMWordPress Avada theme <= 7.11.10 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2023-39311HIGHWordPress Avada Builder plugin <= 3.11.1 - Cross Site Request Forgery (CSRF) vulnerabilityEPSS 0.3%CVE-2026-16654MEDIUMAvada (Fusion) Builder <= 3.15.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' Shortcode AttributeEPSS 0.3%CVE-2026-12536MEDIUMAvada Builder <= 3.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module TitleEPSS 0.3%