EUVD-2024-46809

🗓️ 03 Oct 2025 20:07:09Reported by EUVDType

Avada WordPress plugin has Stored Cross-Site Scripting vulnerability allowing script injections for authenticated users.

Reporter	Title	Published	Views	Family All 12
ATTACKERKB	CVE-2024-5628	13 Sep 202406:15	–	attackerkb
Circl	CVE-2024-5628	13 Sep 202408:45	–	circl
CNNVD	WordPress plugin Avada 跨站脚本漏洞	13 Sep 202400:00	–	cnnvd
CVE	CVE-2024-5628	13 Sep 202405:30	–	cve
Cvelist	CVE-2024-5628 Avada \| Website Builder For WordPress & eCommerce <= 3.11.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via fusion_button Shortcode	13 Sep 202405:30	–	cvelist
NVD	CVE-2024-5628	13 Sep 202406:15	–	nvd
Patchstack	WordPress Fusion Builder Plugin <= 3.11.9 is vulnerable to Cross Site Scripting (XSS)	13 Sep 202400:00	–	patchstack
Patchstack	WordPress Avada \| Website Builder For WordPress & eCommerce plugin <= 3.11.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via fusion_button Shortcode vulnerability	13 Sep 202406:01	–	patchstack
Positive Technologies	PT-2024-36778 · WordPress · Avada	12 Sep 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-5628	23 May 202508:30	–	redhatcve

[
  {
    "enisaIdVendor": [
      {
        "id": "e84e9924-bf1e-3427-b08f-68d0b9a4e95a",
        "vendor": {
          "name": "ThemeFusion"
        }
      }
    ],
    "enisaIdProduct": [
      {
        "id": "2754a4a5-303f-3e7d-b312-245d5c76faa1",
        "product": {
          "name": "Fusion Builder"
        },
        "product_version": "* ≤3.11.9"
      }
    ]
  }
]

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/7c23bd29-ba02-4c90-a631-5ce6294d7760
avada	www.avada.com/documentation/avada-changelog/
avada	www.avada.com/blog/version-7-11-9-security-update/

03 Oct 2025 20:07Current

6.5Medium risk

Vulners AI Score6.5

CVSS 3.15.4 - 6.4

EPSS0.00489

SSVC