Avada (Fusion) Builder vulnerabilities
3 known CVE vulnerabilities in Avada (Fusion) Builder, translated and rated.
- CVE-2026-16654Medium
The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'size' Shortcode Attribute in all versions up to, and including, 3.15.6 due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or above can inject arbitrary web scripts that execute whenever a user accesses an injected page.
- CVE-2026-12536Medium
The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Module Title' parameter in all versions up to and including 3.15.5 due to insufficient input sanitization and output escaping.
- CVE-2026-1543Medium
The Avada (Fusion) Builder plugin for WordPress up to version 3.15.2 is vulnerable to stored XSS via multiple shortcodes due to insufficient input sanitization and output escaping.