Avada | Website Builder For WordPress & WooCommerce

Software Type	Theme
Software Slug	Avada
Software Status	Active
Software Author	ThemeFusion
Software Website	themeforest.net
Software Record Last Updated	May 1, 2024

18 Vulnerabilities

Submit a Vulnerability

Avada | Website Builder For WordPress & WooCommerce <= 7.11.4 - Authenticated (Contributor+) Arbitrary File Upload

8.8

CVE-2024-1468

Feb 28, 2024

Researcher: Muhammad Zeeshan (Xib3rR4dAr)

Avada <= 7.11.1 - Authenticated(Author+) Arbitrary File Upload via Zip Extraction

8.8

CVE-2023-39312

Aug 10, 2023

Researcher: Rafie Muhammad

Avada <= 7.8.1 - Cross-Site Request Forgery

8.8

CVE-2022-41996

Sep 21, 2022

Researcher: Dave Jong

Avada <= 5.1.4 - Cross-Site Request Forgery

8.8

CVE-2017-18607

Apr 26, 2017

Researchers:

Avada <= 7.11.1 - Authenticated(Contributor+) Server Side Request Forgery via 'ajax_import_options'

8.5

CVE-2023-39313

Aug 10, 2023

Researcher: Rafie Muhammad

Fusion Builder <= 3.6.1 & Avada <= 7.6.1 - Unauthenticated Server-Side Request Forgery

8.3

CVE-2022-1386

Apr 19, 2022

Researcher: Calum Elrick

Avada <= 7.11.1 - Authenticated(Contributor+) Arbitrary File Upload via 'ajax_import_options'

7.5

CVE-2023-39307

Aug 10, 2023

Researcher: Rafie Muhammad

Avada <= 7.11.6 - Authenticated (Admin+) SQL Injection via entry

7.2

CVE-2024-2344

Mar 20, 2024

Researcher: Muhammad Zeeshan (Xib3rR4dAr)

Avada <= 7.11.5 - Authenticated(Contributor+) Sensitive Information Exposure via Form Entries

6.5

CVE-2024-1668

Mar 1, 2024

Researcher: Muhammad Zeeshan (Xib3rR4dAr)

Avada <= 7.11.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4

CVE-2024-2311

Mar 20, 2024

Researcher: Muhammad Zeeshan (Xib3rR4dAr)

Avada <= 7.11.6 - Authenticated (Contributor+) Server-Side Request Forgery via form_to_url_action

6.4

CVE-2024-2343

Mar 20, 2024

Researcher: Muhammad Zeeshan (Xib3rR4dAr)

Avada <= 7.4.1 - Stored Cross-Site Scripting

6.4

CVE ID Unknown

Sep 10, 2021

Researcher: Theme Fusion

Avada <= 6.2.2 - Authenticated (Contributor+) Cross-Site Scripting

6.4

CVE-2020-36711

Apr 24, 2020

Researcher: Jerome Bruandet

Avada <= 7.4.1 - Reflected Cross-Site Scripting

6.1

CVE ID Unknown

Sep 10, 2021

Researcher: Theme Fusion

Avada <= 5.1.4 - Stored Cross-Site Scripting

6.1

CVE-2017-18606

Apr 26, 2017

Researchers:

Avada <= 7.11.6 - Unauthenticated Sensitive Information Exposure via Form Uploads Directory Listing

5.3

CVE-2024-2340

Mar 20, 2024

Researcher: Muhammad Zeeshan (Xib3rR4dAr)

Avada <= 7.11.10 - Cross-Site Request Forgery

4.3

CVE-2024-54357

Dec 11, 2024

Researcher: Ananda Dhakal

Avada <= 7.11.1 - Missing Authorization

4.3

CVE-2023-39922

Aug 10, 2023

Researcher: Rafie Muhammad

Title	Status	CVE ID	CVSS	Researchers	Date
Avada \| Website Builder For WordPress & WooCommerce <= 7.11.4 - Authenticated (Contributor+) Arbitrary File Upload	Patched	CVE-2024-1468	8.8	Muhammad Zeeshan (Xib3rR4dAr)	February 28, 2024
Avada <= 7.11.1 - Authenticated(Author+) Arbitrary File Upload via Zip Extraction	Patched	CVE-2023-39312	8.8	Rafie Muhammad	August 10, 2023
Avada <= 7.8.1 - Cross-Site Request Forgery	Patched	CVE-2022-41996	8.8	Dave Jong	September 21, 2022
Avada <= 5.1.4 - Cross-Site Request Forgery	Patched	CVE-2017-18607	8.8		April 26, 2017
Avada <= 7.11.1 - Authenticated(Contributor+) Server Side Request Forgery via 'ajax_import_options'	Patched	CVE-2023-39313	8.5	Rafie Muhammad	August 10, 2023
Fusion Builder <= 3.6.1 & Avada <= 7.6.1 - Unauthenticated Server-Side Request Forgery	Patched	CVE-2022-1386	8.3	Calum Elrick	April 19, 2022
Avada <= 7.11.1 - Authenticated(Contributor+) Arbitrary File Upload via 'ajax_import_options'	Patched	CVE-2023-39307	7.5	Rafie Muhammad	August 10, 2023
Avada <= 7.11.6 - Authenticated (Admin+) SQL Injection via entry	Patched	CVE-2024-2344	7.2	Muhammad Zeeshan (Xib3rR4dAr)	March 20, 2024
Avada <= 7.11.5 - Authenticated(Contributor+) Sensitive Information Exposure via Form Entries	Patched	CVE-2024-1668	6.5	Muhammad Zeeshan (Xib3rR4dAr)	March 1, 2024
Avada <= 7.11.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	Patched	CVE-2024-2311	6.4	Muhammad Zeeshan (Xib3rR4dAr)	March 20, 2024
Avada <= 7.11.6 - Authenticated (Contributor+) Server-Side Request Forgery via form_to_url_action	Patched	CVE-2024-2343	6.4	Muhammad Zeeshan (Xib3rR4dAr)	March 20, 2024
Avada <= 7.4.1 - Stored Cross-Site Scripting	Patched		6.4	Theme Fusion	September 10, 2021
Avada <= 6.2.2 - Authenticated (Contributor+) Cross-Site Scripting	Patched	CVE-2020-36711	6.4	Jerome Bruandet	April 24, 2020
Avada <= 7.4.1 - Reflected Cross-Site Scripting	Patched		6.1	Theme Fusion	September 10, 2021
Avada <= 5.1.4 - Stored Cross-Site Scripting	Patched	CVE-2017-18606	6.1		April 26, 2017
Avada <= 7.11.6 - Unauthenticated Sensitive Information Exposure via Form Uploads Directory Listing	Patched	CVE-2024-2340	5.3	Muhammad Zeeshan (Xib3rR4dAr)	March 20, 2024
Avada <= 7.11.10 - Cross-Site Request Forgery	Patched	CVE-2024-54357	4.3	Ananda Dhakal	December 11, 2024
Avada <= 7.11.1 - Missing Authorization	Patched	CVE-2023-39922	4.3	Rafie Muhammad	August 10, 2023

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation