Theme security history

Avada | Website Builder For WordPress & WooCommerce Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 23 vulnerability records associated with Avada | Website Builder For WordPress & WooCommerce, published between 2017 and 2026.

Dataset last synchronized: 2026-08-02 09:41:47 UTC

At a glance

Security Snapshot

23Total records

0Critical

10High

13Medium

0Low

0Informational

23Patched records

0Currently marked unpatched

2017-04-26First disclosure

2026-06-15Latest disclosure

21 of 23CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2017	2	2 records
2020	1	1 records
2021	2	2 records
2022	2	2 records
2023	4	4 records
2024	7	7 records
2025	3	3 records
2026	2	2 records

Severity Breakdown

Severity	Records	Share
High	10	43.5%
Medium	13	56.5%

Vulnerability-Type Breakdown

Cross-Site Scripting

5 records21.7%

First: 2017. Latest: 2024.

Other

5 records21.7%

First: 2022. Latest: 2026.

CSRF

4 records17.4%

First: 2017. Latest: 2026.

Arbitrary File Upload

3 records13%

First: 2023. Latest: 2024.

Missing Authorization

3 records13%

First: 2023. Latest: 2025.

Privilege Escalation

1 record4.3%

First: 2024. Latest: 2024.

Information Disclosure

1 record4.3%

First: 2024. Latest: 2024.

SQL Injection

1 record4.3%

First: 2024. Latest: 2024.

Patch Status

Patched: 23
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

3.15.4
7.13.2
7.13.3
7.11.14
7.11.11
7.11.7
7.11.6
7.11.5
7.11.2
7.8.2
7.6.2
7.4.2
6.2.3
5.1.5

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-3.15.3`	Avada <= 3.15.3 - Authenticated (Contributor+) PHP Object Injection	June 15, 2026	3.15.4	High
`[*, 7.13.2)`	Avada < 7.13.2 - Cross-Site Request Forgery	April 22, 2026	7.13.2	Medium
`*-7.13.2`	Avada <= 7.13.2 - Missing Authorization	October 3, 2025	7.13.3	Medium
`*-7.11.13`	Avada Theme <= 7.11.13 - Unauthenticated Arbitrary Shortcode Execution	February 12, 2025	7.11.14	High
`*-7.11.10`	Avada <= 7.11.10 - Missing Authorization	January 24, 2025	7.11.11	Medium
`*-7.11.10`	Avada <= 7.11.10 - Cross-Site Request Forgery	December 11, 2024	7.11.11	Medium
`*-7.11.6`	Avada <= 7.11.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	March 20, 2024	7.11.7	Medium
`*-7.11.6`	Avada <= 7.11.6 - Authenticated (Admin+) SQL Injection via entry	March 20, 2024	7.11.7	High
`*-7.11.6`	Avada <= 7.11.6 - Unauthenticated Sensitive Information Exposure via Form Uploads Directory Listing	March 20, 2024	7.11.7	Medium
`*-7.11.6`	Avada <= 7.11.6 - Authenticated (Contributor+) Server-Side Request Forgery via form_to_url_action	March 20, 2024	7.11.7	Medium
`*-7.11.5`	Avada <= 7.11.5 - Authenticated(Contributor+) Sensitive Information Exposure via Form Entries	March 1, 2024	7.11.6	Medium
`*-7.11.4`	Avada \| Website Builder For WordPress & WooCommerce <= 7.11.4 - Authenticated (Contributor+) Arbitrary File Upload	February 28, 2024	7.11.5	High
`*-7.11.1`	Avada <= 7.11.1 - Authenticated(Author+) Arbitrary File Upload via Zip Extraction	August 10, 2023	7.11.2	High
`*-7.11.1`	Avada <= 7.11.1 - Missing Authorization	August 10, 2023	7.11.2	Medium
`*-7.11.1`	Avada <= 7.11.1 - Authenticated(Contributor+) Arbitrary File Upload via 'ajax_import_options'	August 10, 2023	7.11.2	High
`*-7.11.1`	Avada <= 7.11.1 - Authenticated(Contributor+) Server Side Request Forgery via 'ajax_import_options'	August 10, 2023	7.11.2	High
`*-7.8.1`	Avada <= 7.8.1 - Cross-Site Request Forgery	September 21, 2022	7.8.2	High
`[*, 7.6.2)`	Fusion Builder <= 3.6.1 & Avada <= 7.6.1 - Unauthenticated Server-Side Request Forgery	April 19, 2022	7.6.2	High
`*-7.4.1`	Avada <= 7.4.1 - Stored Cross-Site Scripting	September 10, 2021	7.4.2	Medium
`*-7.4.1`	Avada <= 7.4.1 - Reflected Cross-Site Scripting	September 10, 2021	7.4.2	Medium
`[*, 6.2.3)`	Avada <= 6.2.2 - Authenticated (Contributor+) Cross-Site Scripting	April 24, 2020	6.2.3	Medium
`[*, 5.1.5)`	Avada <= 5.1.4 - Cross-Site Request Forgery	April 26, 2017	5.1.5	High
`[*, 5.1.5)`	Avada <= 5.1.4 - Stored Cross-Site Scripting	April 26, 2017	5.1.5	Medium

Selected source records

Latest Records

HighCVE-2026-12256

Avada <= 3.15.3 - Authenticated (Contributor+) PHP Object Injection

Published: June 15, 2026

Affected versions: *-3.15.3
Patched versions: 3.15.4

Original Wordfence record

MediumCVE-2025-58922

Avada < 7.13.2 - Cross-Site Request Forgery

Published: April 22, 2026

Affected versions: [*, 7.13.2)
Patched versions: 7.13.2

Original Wordfence record

MediumCVE-2025-64634

Avada <= 7.13.2 - Missing Authorization

Published: October 3, 2025

Affected versions: *-7.13.2
Patched versions: 7.13.3

Original Wordfence record

HighCVE-2024-13346

Avada Theme <= 7.11.13 - Unauthenticated Arbitrary Shortcode Execution

Published: February 12, 2025

Affected versions: *-7.11.13
Patched versions: 7.11.14

Original Wordfence record

MediumCVE-2025-24748

Avada <= 7.11.10 - Missing Authorization

Published: January 24, 2025

Affected versions: *-7.11.10
Patched versions: 7.11.11

Original Wordfence record

MediumCVE-2024-54357

Avada <= 7.11.10 - Cross-Site Request Forgery

Published: December 11, 2024

Affected versions: *-7.11.10
Patched versions: 7.11.11

Original Wordfence record

MediumCVE-2024-2343

Avada <= 7.11.6 - Authenticated (Contributor+) Server-Side Request Forgery via form_to_url_action

Published: March 20, 2024

Affected versions: *-7.11.6
Patched versions: 7.11.7

Original Wordfence record

MediumCVE-2024-2340

Avada <= 7.11.6 - Unauthenticated Sensitive Information Exposure via Form Uploads Directory Listing

Published: March 20, 2024

Affected versions: *-7.11.6
Patched versions: 7.11.7

Original Wordfence record

Highest-Severity Records

HighCVE-2017-18607

Avada <= 5.1.4 - Cross-Site Request Forgery

Published: April 26, 2017

Affected versions: [*, 5.1.5)
Patched versions: 5.1.5

Original Wordfence record

HighCVE-2024-1468

Avada | Website Builder For WordPress & WooCommerce <= 7.11.4 - Authenticated (Contributor+) Arbitrary File Upload

Published: February 28, 2024

Affected versions: *-7.11.4
Patched versions: 7.11.5

Original Wordfence record

HighCVE-2023-39312

Avada <= 7.11.1 - Authenticated(Author+) Arbitrary File Upload via Zip Extraction

Published: August 10, 2023

Affected versions: *-7.11.1
Patched versions: 7.11.2

Original Wordfence record

HighCVE-2022-41996

Avada <= 7.8.1 - Cross-Site Request Forgery

Published: September 21, 2022

Affected versions: *-7.8.1
Patched versions: 7.8.2

Original Wordfence record

HighCVE-2023-39313

Avada <= 7.11.1 - Authenticated(Contributor+) Server Side Request Forgery via 'ajax_import_options'

Published: August 10, 2023

Affected versions: *-7.11.1
Patched versions: 7.11.2

Original Wordfence record

HighCVE-2022-1386

Fusion Builder <= 3.6.1 & Avada <= 7.6.1 - Unauthenticated Server-Side Request Forgery

Published: April 19, 2022

Affected versions: [*, 3.6.2)
Patched versions: 3.6.2

Affected versions: [*, 7.6.2)
Patched versions: 7.6.2

Original Wordfence record

HighCVE-2026-12256

Avada <= 3.15.3 - Authenticated (Contributor+) PHP Object Injection

Published: June 15, 2026

Affected versions: *-3.15.3
Patched versions: 3.15.4

Original Wordfence record

HighCVE-2023-39307

Avada <= 7.11.1 - Authenticated(Contributor+) Arbitrary File Upload via 'ajax_import_options'

Published: August 10, 2023

Affected versions: *-7.11.1
Patched versions: 7.11.2

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory