WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
fusion-builder
Published
2026-05-12
Title
Avada Builder < 3.15.3 - Subscriber+ Arbitrary File Read via 'custom_svg' Shortcode Parameter
Slug
fusion-builder
Published
2026-05-20
Title
Avada (Fusion) Builder < 3.15.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Multiple Shortcodes
Slug
fusion-builder
Published
2026-05-20
Title
Avada (Fusion) Builder < 3.15.3 - Unauthenticated Remote Code Execution via PHP Function Injection
Slug
fusion-builder
Published
2026-06-18
Title
Avada (Fusion) Builder < 3.15.4 - Unauthenticated Arbitrary File Deletion via Form Entry Value
Slug
fusion-builder
Published
2026-06-18
Title
Avada (Fusion) Builder < 3.15.5 - Contributor+ Privilege Escalation
Slug
fusion-builder
Published
2026-06-16
Title
Avada (Fusion) Builder < 3.15.5 - Authenticated (Contributor+) Arbitrary File Deletion
Slug
fusion-builder
Published
2026-06-15
Title
Avada (Fusion) Builder < 3.15.5 - Authenticated (Contributor+) PHP Object Injection
Slug
fusion-builder
Published
2026-07-13
Title
Avada Builder < 3.15.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Title
Slug
fusion-builder
Published
2026-08-25
Title
Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write
Slug
fusion-builder
Published
2026-08-27
Title
Avada (Fusion) Builder < 3.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' Shortcode Attribute
Slug
fusion-builder
Published
2026-10-09
Title
Avada (Fusion) Builder < 3.16.2 - Unauthenticated Arbitrary WordPress Action Invocation via '{action_hook}' Dynamic-Data Token in Form Field
Slug
fusion-builder
Published
2026-10-13
Title
Avada (Fusion) Builder < 3.16.2 - Unauthenticated Sensitive Information Exposure in 'args[link_target]' Parameter via {user_meta} Dynamic Data Token
Slug
fusion-builder
Published
2026-10-27
Title
Avada (Fusion) Builder < 3.16.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tab_index' and 'empty_notice' Shortcode Attributes
Slug
fusion-core
Published
2026-03-10
Title
Avada Core < 5.15.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
fusion-core
Published
2026-03-10
Title
Avada Core < 5.15.0 - Missing Authorization
Slug
fusion-core
Published
2026-07-22
Title
Avada Core < 5.15.7 - Cross-Site Request Forgery
Slug
fusion-engage
Published
2015-04-10
Title
Fusion Engage 1.0.5 - Local File Disclosure
Slug
fusion-extension-gallery
Published
2025-09-22
Title
Fusion Page Builder : Extension - Gallery < 1.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
fusion-slider
Published
2024-06-18
Title
Universal Slider <= 1.6.5 - Authenticated (Contributor+) PHP Object Injection
Slug
fusion-white-label-branding
Published
2026-07-23
Title
Avada Custom Branding <= 1.2 - Missing Authorization
Slug
fusionspan-impexium-single-sign-on
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
fusionspan-impexium-single-sign-on
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
futurio-extra
Published
2022-01-04
Title
Futurio Extra < 1.6.3 - Authenticated SQL Injection
Slug
futurio-extra
Published
2022-01-14
Title
Futurio Extra < 1.6.3 - Subscriber+ User Email Address Disclosure
Slug
futurio-extra
Published
2023-08-11
Title
Futurio Extra < 1.9.1 - Arbitrary Plugin Activation via CSRF