Cross-Site Scripting
10 records37%First: 2023. Latest: 2026.
Plugin security history
Avada (Fusion) Builder Vulnerability History & Security Timeline
The Wordfence Intelligence dataset currently contains 27 vulnerability records associated with Avada (Fusion) Builder, published between 2022 and 2026.
Dataset last synchronized: 2026-08-03 00:31:25 UTC
At a glance
Security Snapshot
27Total records
2Critical
7High
18Medium
0Low
0Informational
27Patched records
0Currently marked unpatched
2022-04-19First disclosure
2026-07-13Latest disclosure
27 of 27CVE coverage
Year-by-Year Timeline
| Year | Records | Relative volume |
|---|---|---|
| 2022 | 1 | |
| 2023 | 4 | |
| 2024 | 2 | |
| 2025 | 5 | |
| 2026 | 15 |
Severity Breakdown
| Severity | Records | Share |
|---|---|---|
| Critical | 2 | 7.4% |
| High | 7 | 25.9% |
| Medium | 18 | 66.7% |
Vulnerability-Type Breakdown
Other
5 records18.5%First: 2022. Latest: 2026.
Missing Authorization
5 records18.5%First: 2023. Latest: 2026.
Path Traversal
3 records11.1%First: 2026. Latest: 2026.
SQL Injection
2 records7.4%First: 2023. Latest: 2026.
CSRF
1 record3.7%First: 2023. Latest: 2023.
Privilege Escalation
1 record3.7%First: 2026. Latest: 2026.
Patch Status
- Patched
- 27
- Currently marked unpatched
- 0
- Unknown status
- 0
Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.
Latest Known Patched Versions
3.15.63.15.43.15.53.15.33.15.23.15.03.14.23.13.33.12.23.11.153.11.143.11.123.11.133.11.103.11.23.6.2
Affected-Version History
Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.
| Affected range | Vulnerability | Published | Patched version | Severity |
|---|---|---|---|---|
*-3.11.1 | Fusion Builder <= 3.11.1 - Cross-Site Request Forgery | August 10, 2023 | 3.11.2 | Medium |
[*, 3.6.2) | Fusion Builder <= 3.6.1 & Avada <= 7.6.1 - Unauthenticated Server-Side Request Forgery | April 19, 2022 | 3.6.2 | High |
Selected source records
Latest Records
MediumCVE-2026-12536
Avada Builder <= 3.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Title
Published: July 13, 2026
- Affected versions
- *-3.15.5
- Patched versions
- 3.15.6
CriticalCVE-2026-8713
Avada (Fusion) Builder <= 3.15.3 - Unauthenticated Arbitrary File Deletion via Form Entry Value
Published: June 18, 2026
- Affected versions
- *-3.15.3
- Patched versions
- 3.15.4
HighCVE-2026-56008
Avada (Fusion) Builder <= 3.15.4 - Authenticated (Contributor+) Privilege Escalation
Published: June 18, 2026
- Affected versions
- *-3.15.4
- Patched versions
- 3.15.5
HighCVE-2026-54193
Avada (Fusion) Builder <= 3.15.4 - Authenticated (Contributor+) Arbitrary File Deletion
Published: June 16, 2026
- Affected versions
- *-3.15.4
- Patched versions
- 3.15.5
HighCVE-2026-54194
Avada (Fusion) Builder <= 3.15.4 - Authenticated (Contributor+) PHP Object Injection
Published: June 15, 2026
- Affected versions
- *-3.15.4
- Patched versions
- 3.15.5
MediumCVE-2026-1543
Avada (Fusion) Builder <= 3.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Multiple Shortcodes
Published: May 20, 2026
- Affected versions
- *-3.15.2
- Patched versions
- 3.15.3
CriticalCVE-2026-6279
Avada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler
Published: May 20, 2026
- Affected versions
- *-3.15.2
- Patched versions
- 3.15.3
HighCVE-2026-4798
Avada Builder <= 3.15.1 - Unauthenticated SQL Injection via 'product_order' Parameter
Published: May 12, 2026
- Affected versions
- *-3.15.1
- Patched versions
- 3.15.2
Highest-Severity Records
CriticalCVE-2026-6279
Avada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler
Published: May 20, 2026
- Affected versions
- *-3.15.2
- Patched versions
- 3.15.3
CriticalCVE-2026-8713
Avada (Fusion) Builder <= 3.15.3 - Unauthenticated Arbitrary File Deletion via Form Entry Value
Published: June 18, 2026
- Affected versions
- *-3.15.3
- Patched versions
- 3.15.4
HighCVE-2026-56008
Avada (Fusion) Builder <= 3.15.4 - Authenticated (Contributor+) Privilege Escalation
Published: June 18, 2026
- Affected versions
- *-3.15.4
- Patched versions
- 3.15.5
HighCVE-2023-39309
Fusion Builder <= 3.11.1 - Authenticated (Subscriber+) SQL Injection
Published: August 10, 2023
- Affected versions
- *-3.11.1
- Patched versions
- 3.11.2
HighCVE-2022-1386
Fusion Builder <= 3.6.1 & Avada <= 7.6.1 - Unauthenticated Server-Side Request Forgery
Published: April 19, 2022
- Affected versions
- [*, 3.6.2)
- Patched versions
- 3.6.2
- Affected versions
- [*, 7.6.2)
- Patched versions
- 7.6.2
HighCVE-2026-54193
Avada (Fusion) Builder <= 3.15.4 - Authenticated (Contributor+) Arbitrary File Deletion
Published: June 16, 2026
- Affected versions
- *-3.15.4
- Patched versions
- 3.15.5
HighCVE-2026-4798
Avada Builder <= 3.15.1 - Unauthenticated SQL Injection via 'product_order' Parameter
Published: May 12, 2026
- Affected versions
- *-3.15.1
- Patched versions
- 3.15.2
HighCVE-2026-54194
Avada (Fusion) Builder <= 3.15.4 - Authenticated (Contributor+) PHP Object Injection
Published: June 15, 2026
- Affected versions
- *-3.15.4
- Patched versions
- 3.15.5
Need help reviewing an exposed WordPress website?
Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.
Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.
Data Source, Attribution and Methodology
This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.