Plugin icon

Fusion Builder

fusion-builder

Vulnerabilities:

24

Last Updated:

n/a

Active Installs:

n/a

Published
Title
Fixed in
CVSS
Published
2026-07-13
Title
Avada Builder < 3.15.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Title
Fixed in
Fixed in 3.15.6
CVSS
5.5 (medium)
Published
2026-06-18
Title
Avada (Fusion) Builder < 3.15.4 - Unauthenticated Arbitrary File Deletion via Form Entry Value
Fixed in
Fixed in 3.15.4
CVSS
9.1 (critical)
Published
2026-06-18
Title
Avada (Fusion) Builder < 3.15.5 - Contributor+ Privilege Escalation
Fixed in
Fixed in 3.15.5
CVSS
7.2 (high)
Published
2026-06-16
Title
Avada (Fusion) Builder < 3.15.5 - Authenticated (Contributor+) Arbitrary File Deletion
Fixed in
Fixed in 3.15.5
CVSS
6.5 (medium)
Published
2026-06-15
Title
Avada (Fusion) Builder < 3.15.5 - Authenticated (Contributor+) PHP Object Injection
Fixed in
Fixed in 3.15.5
CVSS
6.6 (medium)
Published
2026-05-20
Title
Avada (Fusion) Builder < 3.15.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Multiple Shortcodes
Fixed in
Fixed in 3.15.3
CVSS
6.4 (medium)
Published
2026-05-20
Title
Avada (Fusion) Builder < 3.15.3 - Unauthenticated Remote Code Execution via PHP Function Injection
Fixed in
Fixed in 3.15.3
CVSS
9.8 (critical)
Published
2026-05-12
Title
Avada Builder < 3.15.2 - Unauthenticated SQL Injection via 'product_order' Parameter
Fixed in
Fixed in 3.15.2
CVSS
7.5 (high)
Published
2026-05-12
Title
Avada Builder < 3.15.3 - Subscriber+ Arbitrary File Read via 'custom_svg' Shortcode Parameter
Fixed in
Fixed in 3.15.3
CVSS
6.5 (medium)
Published
2026-04-14
Title
Avada (Fusion) Builder < 3.15.2 - Authenticated (Subscriber+) Limited Arbitrary WordPress Action Execution
Fixed in
Fixed in 3.15.2
CVSS
5.4 (medium)
Published
2026-04-14
Title
Avada (Fusion) Builder < 3.15.2 - Authenticated (Subscriber+) Sensitive Information Exposure via Insecure Direct Object Reference
Fixed in
Fixed in 3.15.2
CVSS
4.3 (medium)
Published
2026-03-20
Title
Avada (Fusion) Builder < 3.15.0 - Reflected Cross-Site Scripting
Fixed in
Fixed in 3.15.0
CVSS
6.1 (medium)
Published
2026-03-10
Title
Avada (Fusion) Builder < 3.15.0 - Missing Authorization
Fixed in
Fixed in 3.15.0
CVSS
4.3 (medium)
Published
2026-03-10
Title
Avada (Fusion) Builder < 3.15.0 - Missing Authorization
Fixed in
Fixed in 3.15.0
CVSS
5.3 (medium)
Published
2026-01-15
Title
Avada (Fusion) Builder < 3.14.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 3.14.2
CVSS
5.5 (medium)
Published
2025-10-03
Title
Fusion Builder < 3.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 3.13.3
CVSS
6.4 (medium)
Published
2025-07-15
Title
Avada (Fusion) Builder < 3.12.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Fixed in
Fixed in 3.12.2
CVSS
6.4 (medium)
Published
2025-03-31
Title
Avada Builder < 3.11.15 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 3.11.15
CVSS
6.4 (medium)
Published
2025-02-12
Title
Avada Builder < 3.11.14 - Unauthenticated Arbitrary Shortcode Execution
Fixed in
Fixed in 3.11.14
CVSS
7.3 (high)
Published
2025-01-22
Title
Avada Builder < 3.11.12 - Authenticated (Contributor+) Stored Cross-Site Scripting in Multiple Widgets
Fixed in
Fixed in 3.11.12
CVSS
6.4 (medium)
Published
2024-12-24
Title
Avada Builder < 3.11.13 - Authenticated (Contributor+) Protected Post Disclosure
Fixed in
Fixed in 3.11.13
CVSS
4.3 (medium)
Published
2024-09-12
Title
Avada | Website Builder For WordPress & eCommerce < 3.11.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via fusion_button Shortcode
Fixed in
Fixed in 3.11.10
CVSS
6.4 (medium)
Published
2023-08-10
Title
Fusion Builder < 3.11.2 - Cross Site Scripting (XSS) vulnerability in the User Register element
Fixed in
Fixed in 3.11.2
CVSS
7.5 (high)
Published
2022-04-19
Title
Fusion Builder < 3.6.2 - Unauthenticated SSRF
Fixed in
Fixed in 3.6.2
CVSS
8.6 (high)