WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
fusewp
Published
2025-10-24
Title
FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) < 1.1.23.1 - Cross-Site Request Forgery to Sync Rule Creation
Slug
fusewp
Published
2025-10-30
Title
FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) < 1.1.23.1 - Missing Authorization to Authenticated (Subscriber+) Sync Rule Creation
Slug
fusewp
Published
2026-07-28
Title
FuseWP < 1.1.25.2 - Cross-Site Request Forgery to Sync Rule Status Toggle
Slug
fusion
Published
2024-07-10
Title
Fusion < 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
fusion
Published
2025-03-31
Title
Fusion <= 1.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
fusion-builder
Published
2022-04-19
Title
Fusion Builder < 3.6.2 - Unauthenticated SSRF
Slug
fusion-builder
Published
2023-08-10
Title
Fusion Builder < 3.11.2 - Cross Site Scripting (XSS) vulnerability in the User Register element
Slug
fusion-builder
Published
2024-09-12
Title
Avada | Website Builder For WordPress & eCommerce < 3.11.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via fusion_button Shortcode
Slug
fusion-builder
Published
2024-12-24
Title
Avada Builder < 3.11.13 - Authenticated (Contributor+) Protected Post Disclosure
Slug
fusion-builder
Published
2025-01-22
Title
Avada Builder < 3.11.12 - Authenticated (Contributor+) Stored Cross-Site Scripting in Multiple Widgets
Slug
fusion-builder
Published
2025-02-12
Title
Avada Builder < 3.11.14 - Unauthenticated Arbitrary Shortcode Execution
Slug
fusion-builder
Published
2025-03-31
Title
Avada Builder < 3.11.15 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
fusion-builder
Published
2025-07-15
Title
Avada (Fusion) Builder < 3.12.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Slug
fusion-builder
Published
2025-10-03
Title
Fusion Builder < 3.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
fusion-builder
Published
2026-03-10
Title
Avada (Fusion) Builder < 3.15.0 - Missing Authorization
Slug
fusion-builder
Published
2026-03-10
Title
Avada (Fusion) Builder < 3.15.0 - Missing Authorization
Slug
fusion-builder
Published
2026-03-20
Title
Avada (Fusion) Builder < 3.15.0 - Reflected Cross-Site Scripting
Slug
fusion-builder
Published
2026-04-14
Title
Avada (Fusion) Builder < 3.15.2 - Authenticated (Subscriber+) Sensitive Information Exposure via Insecure Direct Object Reference
Slug
fusion-builder
Published
2026-04-14
Title
Avada (Fusion) Builder < 3.15.2 - Authenticated (Subscriber+) Limited Arbitrary WordPress Action Execution
Slug
fusion-builder
Published
2026-01-15
Title
Avada (Fusion) Builder < 3.14.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
fusion-builder
Published
2026-05-12
Title
Avada Builder < 3.15.2 - Unauthenticated SQL Injection via 'product_order' Parameter
Slug
fusion-builder
Published
2026-05-12
Title
Avada Builder < 3.15.3 - Subscriber+ Arbitrary File Read via 'custom_svg' Shortcode Parameter
Slug
fusion-builder
Published
2026-05-20
Title
Avada (Fusion) Builder < 3.15.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Multiple Shortcodes
Slug
fusion-builder
Published
2026-05-20
Title
Avada (Fusion) Builder < 3.15.3 - Unauthenticated Remote Code Execution via PHP Function Injection
Slug
fusion-builder
Published
2026-06-18
Title
Avada (Fusion) Builder < 3.15.4 - Unauthenticated Arbitrary File Deletion via Form Entry Value