Conoce las vulnerabilidades. Protege tus aplicaciones.

Media 09.10.2026

CVE-2026-97340

Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Cross-Site Scripting persistente autenticado

Una vulnerabilidad en el tema Avada para WordPress permite a atacantes autenticados almacenar scripts maliciosos en enlaces sociales de perfiles de autor, los cuales se ejecutan al hacer clic sobre ellos.

WordPress

avada

Crítica 09.10.2026

CVE-2026-97670

Avada (Fusion) Builder <= 7.16.1 - Unauthenticated Arbitrary WordPress Action Invocation via '{action_hook}' Dynamic-Data Token in Form Field

WordPress

fusion-builder

Media 01.10.2026

CVE-2026-84925

Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Reflected Cross-Site Scripting via 'lang' Parameter

WordPress

avada

Media 27.08.2026

CVE-2026-16654

Avada (Fusion) Builder <= 3.15.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' Shortcode Attribute

WordPress

fusion-builder

Crítica 25.08.2026

CVE-2026-18431

Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write

WordPress

fusion-builder, avada

Media 23.07.2026

CVE-2026-65524

Avada Custom Branding <= 1.2 - Missing Authorization

WordPress

fusion-white-label-branding

Media 22.07.2026

CVE-2026-65471

Avada Core <= 5.15.6 - Cross-Site Request Forgery

WordPress

fusion-core

Media 13.07.2026

CVE-2026-12536

Avada Builder <= 3.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Title

WordPress

fusion-builder

Crítica 18.06.2026

CVE-2026-8713

Avada (Fusion) Builder <= 3.15.3 - Unauthenticated Arbitrary File Deletion via Form Entry Value

WordPress

fusion-builder

Alta 18.06.2026

CVE-2026-56008

Avada (Fusion) Builder <= 3.15.4 - Authenticated (Contributor+) Privilege Escalation

WordPress

fusion-builder

Alta 16.06.2026

CVE-2026-54193

Avada (Fusion) Builder <= 3.15.4 - Authenticated (Contributor+) Arbitrary File Deletion

WordPress

fusion-builder

Alta 15.06.2026

CVE-2026-54194

Avada (Fusion) Builder <= 3.15.4 - Authenticated (Contributor+) PHP Object Injection

WordPress

fusion-builder

Alta 15.06.2026

CVE-2026-12256

Avada <= 3.15.3 - Authenticated (Contributor+) PHP Object Injection

WordPress

avada

Media 20.05.2026

CVE-2026-1543

Avada (Fusion) Builder <= 3.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Multiple Shortcodes

WordPress

fusion-builder

Crítica 20.05.2026

CVE-2026-6279

Avada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler

WordPress

fusion-builder

Alta 12.05.2026

CVE-2026-4798

Avada Builder <= 3.15.1 - Unauthenticated SQL Injection via 'product_order' Parameter

WordPress

fusion-builder

Media 12.05.2026

CVE-2026-4782

Avada Builder <= 3.15.2 - Authenticated (Subscriber+) Arbitrary File Read via 'custom_svg' Shortcode Parameter

WordPress

fusion-builder

Media 22.04.2026

CVE-2025-58922

Avada < 7.13.2 - Cross-Site Request Forgery

WordPress

avada

Media 14.04.2026

CVE-2026-1509

Avada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Limited Arbitrary WordPress Action Execution

WordPress

fusion-builder

Media 14.04.2026

CVE-2026-1541

Avada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Sensitive Information Exposure via Insecure Direct Object Reference

WordPress

fusion-builder

Media 20.03.2026

CVE-2026-32542

Avada (Fusion) Builder < 3.15.0 - Reflected Cross-Site Scripting

WordPress

fusion-builder

Media 10.03.2026

CVE-2026-32453

Avada Core < 5.15.0 - Missing Authorization

WordPress

fusion-core

Media 10.03.2026

CVE-2026-32451

Avada (Fusion) Builder < 3.15.0 - Missing Authorization

WordPress

fusion-builder

Media 10.03.2026

CVE-2026-32454

Avada Core < 5.15.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

WordPress

fusion-core