themefusion Avada vulnerabilities

Latest themefusion Avada CVEs

Newest publication first

1. CVE-2025-58922 WordPress Avada theme < 7.13.2 - Cross Site Request Forgery (CSRF) vulnerability

   Published 2026-04-22

   Medium·CVSS 4.3 EPSS 0.10%

   Cross-Site Request Forgery (CSRF) vulnerability in ThemeFusion Avada allows Cross Site Request Forgery.This issue affects Avada: from n/a before 7.13.2.

2. CVE-2025-64634 WordPress Avada theme <= 7.13.2 - Broken Access Control vulnerability

   Published 2025-12-16

   Medium·CVSS 5.3 EPSS 0.25%

   Missing Authorization vulnerability in ThemeFusion Avada avada allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Avada: from n/a through <= 7.13.2.

3. CVE-2025-24748 WordPress Avada theme <= 7.11.10 - Broken Access Control vulnerability

   Published 2025-07-04

   Medium·CVSS 5.3 EPSS 0.26%

   Missing Authorization vulnerability in ThemeFusion Avada avada.This issue affects Avada: from n/a through <= 7.11.10.

4. CVE-2024-54357 WordPress Avada theme <= 7.11.10 - Cross Site Request Forgery (CSRF) vulnerability

   Published 2024-12-16

   Medium·CVSS 4.3 EPSS 0.18%

   Cross-Site Request Forgery (CSRF) vulnerability in ThemeFusion Avada avada.This issue affects Avada: from n/a through <= 7.11.10.

5. CVE-2023-39312 WordPress Avada theme <= 7.11.1 - Auth. Unrestricted Zip Extraction vulnerability

   Published 2024-06-19

   High·CVSS 8.8 EPSS 0.59%

   Missing Authorization vulnerability in ThemeFusion Avada.This issue affects Avada: from n/a through 7.11.1.

6. CVE-2023-39922 WordPress Avada theme <= 7.11.1 - Authenticated Broken Access Control vulnerability

   Published 2024-06-19

   High·CVSS 8.8 EPSS 0.37%

   Missing Authorization vulnerability in ThemeFusion Avada.This issue affects Avada: from n/a through 7.11.1.

7. CVE-2023-39313 WordPress Avada theme <= 7.11.1 - Authenticated Server Side Request Forgery (SSRF) vulnerability

   Published 2024-03-28

   High·CVSS 7.7 EPSS 0.57%

   Server-Side Request Forgery (SSRF) vulnerability in ThemeFusion Avada.This issue affects Avada: from n/a through 7.11.1.

8. CVE-2023-39307 WordPress Avada theme <= 7.11.1 - Authenticated Arbitrary File Upload vulnerability

   Published 2024-03-26

   High·CVSS 8.8 EPSS 0.67%

   Unrestricted Upload of File with Dangerous Type vulnerability in ThemeFusion Avada.This issue affects Avada: from n/a through 7.11.1.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.