# Avada (Fusion) Builder

> Not on WordPress.org: a premium or commercial plugin that updates from its vendor.

Source: https://todaywp.com (Today WP, free and read-only). 

## Facts

- Slug: fusion-builder
- To check an installed version: wp_security with plugins "fusion-builder:<version>".

## Known vulnerabilities

- 2026-10-28 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via 'tab_index' and 'empty_notice' Shortcode Attributes (up to 3.16.2). CVE-2026-104729, https://www.wordfence.com/threat-intel/vulnerabilities/id/650d346d-c30a-4ee1-ac50-6a264e181174?source=api-prod
- 2026-10-14 MEDIUM: Unauthenticated Sensitive Information Exposure in 'args[link_target]' Parameter via {user_meta} Dynamic Data Token (up to 3.16.1). CVE-2026-97471, https://www.wordfence.com/threat-intel/vulnerabilities/id/ebbd41a8-b9ff-4afe-bcfd-1df52d8d3b5f?source=api-prod
- 2026-10-10 CRITICAL:  Unauthenticated Arbitrary WordPress Action Invocation via '{action_hook}' Dynamic-Data Token in Form Field (up to 3.16.1). CVE-2026-97670, https://www.wordfence.com/threat-intel/vulnerabilities/id/e2c00795-c49b-4b0a-8f0a-4ed18c966c6b?source=api-prod
- 2026-08-28 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' Shortcode Attribute (up to 3.15.6). CVE-2026-16654, https://www.wordfence.com/threat-intel/vulnerabilities/id/8d3c29b8-7910-41f1-b203-6c89519f8806?source=api-prod
- 2026-08-25 CRITICAL: Unauthenticated Remote Code Execution via Arbitrary File Write (up to 3.16). WF-5bef5bd3-8ec9-4a5b-bcdd-98952c7ef390, https://www.wordfence.com/threat-intel/vulnerabilities/id/5bef5bd3-8ec9-4a5b-bcdd-98952c7ef390?source=api-prod
- 2026-07-13 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Module Title (up to 3.15.5). CVE-2026-12536, https://www.wordfence.com/threat-intel/vulnerabilities/id/6199b852-3270-4456-934b-68c3ef11b9e5?source=api-prod
- 2026-06-26 HIGH: Authenticated (Contributor+) Privilege Escalation (up to 3.15.4). CVE-2026-56008, https://www.wordfence.com/threat-intel/vulnerabilities/id/5ca35c9d-a7e0-4442-82d5-5040a3443c2b?source=api-prod
- 2026-06-19 CRITICAL: Unauthenticated Arbitrary File Deletion via Form Entry Value (up to 3.15.3). CVE-2026-8713, https://www.wordfence.com/threat-intel/vulnerabilities/id/e4bfb72e-023b-4bfd-b125-91f6ac2f200f?source=api-prod
- 2026-06-17 HIGH: Authenticated (Contributor+) PHP Object Injection (up to 3.15.4). CVE-2026-54194, https://www.wordfence.com/threat-intel/vulnerabilities/id/a84da684-17b3-43d7-b8dd-2570ee44851e?source=api-prod
- 2026-06-17 HIGH: Authenticated (Contributor+) Arbitrary File Deletion (up to 3.15.4). CVE-2026-54193, https://www.wordfence.com/threat-intel/vulnerabilities/id/ea5533ab-068a-4a94-bf0a-fc15fcfb383b?source=api-prod
- 2026-05-21 MEDIUM: Authenticated (Subscriber+) Stored Cross-Site Scripting via Multiple Shortcodes (up to 3.15.2). CVE-2026-1543, https://www.wordfence.com/threat-intel/vulnerabilities/id/72a6b040-ed02-4561-82f2-4adb820bdf7d?source=api-prod
- 2026-05-21 CRITICAL: Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler (up to 3.15.2). CVE-2026-6279, https://www.wordfence.com/threat-intel/vulnerabilities/id/5dc72d78-d47c-4b36-8d69-8672e15ddf8c?source=api-prod
- 2026-05-13 MEDIUM: Authenticated (Subscriber+) Arbitrary File Read via 'custom_svg' Shortcode Parameter (up to 3.15.2). CVE-2026-4782, https://www.wordfence.com/threat-intel/vulnerabilities/id/86346be9-7ca6-49b7-83b2-01a335d48c94?source=api-prod
- 2026-05-13 HIGH: Unauthenticated SQL Injection via 'product_order' Parameter (up to 3.15.1). CVE-2026-4798, https://www.wordfence.com/threat-intel/vulnerabilities/id/22b55747-8b46-4812-9345-0db03500105f?source=api-prod
- 2026-04-15 MEDIUM: Authenticated (Subscriber+) Limited Arbitrary WordPress Action Execution (up to 3.15.1). CVE-2026-1509, https://www.wordfence.com/threat-intel/vulnerabilities/id/fdc57b06-bae9-49a3-84dd-f593705330e9?source=api-prod
- 2026-04-15 MEDIUM: Authenticated (Subscriber+) Sensitive Information Exposure via Insecure Direct Object Reference (up to 3.15.1). CVE-2026-1541, https://www.wordfence.com/threat-intel/vulnerabilities/id/f1f69f93-80e3-434d-98a6-fc8757b4e6d1?source=api-prod
- 2026-03-20 MEDIUM: Reflected Cross-Site Scripting (before 3.15.0). CVE-2026-32542, https://www.wordfence.com/threat-intel/vulnerabilities/id/f946c5b9-a227-47bd-bae2-decbb5748436?source=api-prod
- 2026-03-10 MEDIUM: Missing Authorization (before 3.15.0). CVE-2026-32452, https://www.wordfence.com/threat-intel/vulnerabilities/id/149ef56e-b9a6-4d28-9c90-0e2fa917ada6?source=api-prod
- 2026-03-10 MEDIUM: Missing Authorization (before 3.15.0). CVE-2026-32451, https://www.wordfence.com/threat-intel/vulnerabilities/id/2f881298-23f3-471c-b6f1-ebaf72d7180e?source=api-prod
- 2026-01-15 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 3.14.1). CVE-2026-25472, https://www.wordfence.com/threat-intel/vulnerabilities/id/67f23705-ee04-40a7-a4d9-3bf654a2cb12?source=api-prod
- 2025-10-03 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 3.13.2). CVE-2025-49940, https://www.wordfence.com/threat-intel/vulnerabilities/id/9fe3d648-d6b3-4363-b449-bfc0f5b9c1ea?source=api-prod
- 2025-07-15 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (up to 3.12.1). CVE-2025-6747, https://www.wordfence.com/threat-intel/vulnerabilities/id/f0a21eaa-4e2a-4d07-8635-f0a8a5db660f?source=api-prod
- 2025-03-31 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 3.11.14). CVE-2025-1665, https://www.wordfence.com/threat-intel/vulnerabilities/id/94e373fb-b3f5-4c1b-9eaa-89747af4dc30?source=api-prod
- 2025-02-12 HIGH: Unauthenticated Arbitrary Shortcode Execution (up to 3.11.13). CVE-2024-13345, https://www.wordfence.com/threat-intel/vulnerabilities/id/94f6aab3-49a7-4837-a424-e40e483f3f68?source=api-prod
- 2025-01-22 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting in Multiple Widgets (up to 3.11.11). CVE-2024-12477, https://www.wordfence.com/threat-intel/vulnerabilities/id/7c54588f-6436-406f-93cb-b08965586d11?source=api-prod
- 2024-12-24 MEDIUM: Authenticated (Contributor+) Protected Post Disclosure (up to 3.11.12). CVE-2024-12335, https://www.wordfence.com/threat-intel/vulnerabilities/id/4181dcad-b5bd-46db-b47c-3cdee427123c?source=api-prod
- 2024-09-12 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via fusion_button Shortcode (up to 3.11.9). CVE-2024-5628, https://www.wordfence.com/threat-intel/vulnerabilities/id/7c23bd29-ba02-4c90-a631-5ce6294d7760?source=api-prod
- 2023-08-10 MEDIUM: Cross-Site Request Forgery (up to 3.11.1). CVE-2023-39311, https://www.wordfence.com/threat-intel/vulnerabilities/id/05220967-dd42-4cb9-9c2f-9c7ac3c0926b?source=api-prod
- 2023-08-10 MEDIUM: Missing Authorization (up to 3.11.1). CVE-2023-39310, https://www.wordfence.com/threat-intel/vulnerabilities/id/35b3a82a-4391-41b0-b434-691743c5ff4d?source=api-prod
- 2023-08-10 HIGH: Authenticated (Subscriber+) SQL Injection (up to 3.11.1). CVE-2023-39309, https://www.wordfence.com/threat-intel/vulnerabilities/id/7c734aa9-ee9e-4605-a4b8-5075ce4b941f?source=api-prod
- 2023-08-10 MEDIUM: Reflected Cross-Site Scripting via User Register Element (up to 3.11.1). CVE-2023-39306, https://www.wordfence.com/threat-intel/vulnerabilities/id/b173523a-e79d-4d2d-af67-5372576df220?source=api-prod
- 2022-04-19 HIGH: Unauthenticated Server-Side Request Forgery (before 3.6.2). WF-ad3de7e6-a080-4ce8-aa27-21e7f8fdb2c7, https://www.wordfence.com/threat-intel/vulnerabilities/id/ad3de7e6-a080-4ce8-aa27-21e7f8fdb2c7?source=api-prod

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.