WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
fusion-builder
Published
2025-10-03
Title
Fusion Builder < 3.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
fusion-builder
Published
2026-03-10
Title
Avada (Fusion) Builder < 3.15.0 - Missing Authorization
Slug
fusion-builder
Published
2026-03-10
Title
Avada (Fusion) Builder < 3.15.0 - Missing Authorization
Slug
fusion-builder
Published
2026-03-20
Title
Avada (Fusion) Builder < 3.15.0 - Reflected Cross-Site Scripting
Slug
fusion-builder
Published
2026-04-14
Title
Avada (Fusion) Builder < 3.15.2 - Authenticated (Subscriber+) Sensitive Information Exposure via Insecure Direct Object Reference
Slug
fusion-builder
Published
2026-04-14
Title
Avada (Fusion) Builder < 3.15.2 - Authenticated (Subscriber+) Limited Arbitrary WordPress Action Execution
Slug
fusion-builder
Published
2026-01-15
Title
Avada (Fusion) Builder < 3.14.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
fusion-builder
Published
2026-05-12
Title
Avada Builder < 3.15.2 - Unauthenticated SQL Injection via 'product_order' Parameter
Slug
fusion-builder
Published
2026-05-12
Title
Avada Builder < 3.15.3 - Subscriber+ Arbitrary File Read via 'custom_svg' Shortcode Parameter
Slug
fusion-builder
Published
2026-05-20
Title
Avada (Fusion) Builder < 3.15.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Multiple Shortcodes
Slug
fusion-builder
Published
2026-05-20
Title
Avada (Fusion) Builder < 3.15.3 - Unauthenticated Remote Code Execution via PHP Function Injection
Slug
fusion-builder
Published
2026-06-18
Title
Avada (Fusion) Builder < 3.15.4 - Unauthenticated Arbitrary File Deletion via Form Entry Value
Slug
fusion-builder
Published
2026-06-18
Title
Avada (Fusion) Builder < 3.15.5 - Contributor+ Privilege Escalation
Slug
fusion-builder
Published
2026-06-16
Title
Avada (Fusion) Builder < 3.15.5 - Authenticated (Contributor+) Arbitrary File Deletion
Slug
fusion-builder
Published
2026-06-15
Title
Avada (Fusion) Builder < 3.15.5 - Authenticated (Contributor+) PHP Object Injection
Slug
fusion-builder
Published
2026-07-13
Title
Avada Builder < 3.15.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Title
Slug
fusion-core
Published
2026-03-10
Title
Avada Core < 5.15.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
fusion-core
Published
2026-03-10
Title
Avada Core < 5.15.0 - Missing Authorization
Slug
fusion-engage
Published
2015-04-10
Title
Fusion Engage 1.0.5 - Local File Disclosure
Slug
fusion-extension-gallery
Published
2025-09-22
Title
Fusion Page Builder : Extension - Gallery < 1.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
fusion-slider
Published
2024-06-18
Title
Universal Slider <= 1.6.5 - Authenticated (Contributor+) PHP Object Injection
Slug
fusionspan-impexium-single-sign-on
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
fusionspan-impexium-single-sign-on
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
futurio-extra
Published
2022-01-04
Title
Futurio Extra < 1.6.3 - Authenticated SQL Injection
Slug
futurio-extra
Published
2022-01-14
Title
Futurio Extra < 1.6.3 - Subscriber+ User Email Address Disclosure