Fusion Builder vulnerabilities

In Fusion Builder versions <= 3.15.4, there is a vulnerability that allows arbitrary file deletion by users with appropriate permissions.

Fusion Builder versions up to 3.15.4 are vulnerable to PHP Object Injection, which may lead to unauthorized access or data manipulation.

The Fusion Builder plugin for WordPress versions 3.15.4 and earlier contains a privilege escalation vulnerability exploitable by contributors. An attacker with contributor role can gain unauthorized access to administrative functions.

Deserialization of Untrusted Data vulnerability in ThemeFusion Fusion Builder fusion-builder allows Object Injection. This issue affects Fusion Builder from n/a through 3.15.3.

Fusion Builder up to version 3.13.2 contains a DOM-Based XSS vulnerability due to improper input neutralization during web page generation. This allows an attacker to execute malicious scripts in the victim's browser.