Session fixation

The Fusion Builder WordPress plugin before 3.6.2, used in the Avada theme, does not validate a parameter in its forms which could be used to initiate arbitrary HTTP requests. The data returned is then reflected back in the application's response. This could be used to interact with hosts on the...

CVE-2022-1386 Fusion Builder < 3.6.2 - Unauthenticated SSRF

The Fusion Builder WordPress plugin before 3.6.2, used in the Avada theme, does not validate a parameter in its forms which could be used to initiate arbitrary HTTP requests. The data returned is then reflected back in the application's response. This could be used to interact with hosts on the...

CVE-2022-1386

CVE-2022-1386 : The WordPress Fusion Builder plugin (before 3.6.2) used with the Avada theme is vulnerable to a server-side request forgery (SSRF). The plugin does not validate a parameter in its forms, allowing an attacker to initiate arbitrary HTTP requests, with the response echoed back to the...

Fusion Builder < 3.6.2 - Unauthenticated SSRF

Description The plugin, used in the Avada theme, does not validate a parameter in its forms which could be used to initiate arbitrary HTTP requests. The data returned is then reflected back in the application's response. This could be used to interact with hosts on the server's local network...

Avada < 7.4.2 - Reflected Cross-Site Scripting

Description The theme does not properly escape bbPress searches before outputting them back as breadcrumbs, leading to a Reflected Cross-Site Scripting issue. PoC https://theme-fusion.com/forums/search/z-- FAIL/...

Avada < 6.2.3 - Missing Permission Checks leading to Arbitrary Post Creation, Edition, Deletion and Stored XSS

Description NinTechNet disclosed multiple security vulnerabilities affecting the premium Avada WordPress theme on their blog after responsibly disclosing the security vulnerabilities to Avada. These vulnerabilities included: - Content Injection & Stored XSS - Arbitrary Post Deletion - Arbitrary...

avada theme for WordPress cross-site scripting vulnerability

avada theme for WordPress is a responsive multipurpose theme plugin for use in WordPress. A cross-site scripting vulnerability exists in avada theme for WordPress versions prior to 5.1.5. The vulnerability stems from a lack of proper validation of client-side data by the web application. An...

CVE-2017-18606

The avada theme before 5.1.5 for WordPress has stored XSS...

CVE-2017-18607

The avada theme before 5.1.5 for WordPress has CSRF...

CVE-2017-18606

The avada theme before 5.1.5 for WordPress has stored XSS...

CVE-2017-18607

The avada theme before 5.1.5 for WordPress has CSRF...

Cross site request forgery (csrf)

The avada theme before 5.1.5 for WordPress has CSRF...

Cross site scripting

The avada theme before 5.1.5 for WordPress has stored XSS...

CVE-2017-18607

The avada theme before 5.1.5 for WordPress has CSRF...

CVE-2017-18607

CVE-2017-18607 affects the Avada WordPress theme prior to 5.1.5. The NVD entry documents a CSRF vulnerability (pre-5.1.5) with CVSS v3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (base 8.8) and CVSS v2: AV:N/AC:M/Au:N/C:P/I:P/A:P (base 6.8). Connected sources also reference related issues in older bui...

CVE-2017-18606

The avada theme before 5.1.5 for WordPress has stored XSS...

CVE-2017-18606

The CVE-2017-18606 entry concerns the Avada WordPress theme (before 5.1.5) with a stored XSS vulnerability. Connected sources confirm the root cause as insufficient validation of client-side data leading to cross-site scripting. Affected product: Avada theme for WordPress prior to 5.1.5. Impact: ...

Avada Theme <= 5.1.4 - Stored Cross-Site Scripting (XSS) & CSRF

Description The Avada WordPress theme was affected by a Stored Cross-Site Scripting XSS & CSRF security vulnerability. PoC http://cdn.wphutte.com/Avada/5.1.4/xss.html http://cdn.wphutte.com/Avada/5.1.4/csrf.html...

Avada Theme <= 5.1.4 - Stored Cross-Site Scripting (XSS) & CSRF

Description The Avada WordPress theme was affected by a Stored Cross-Site Scripting XSS & CSRF security vulnerability. http://cdn.wphutte.com/Avada/5.1.4/xss.html http://cdn.wphutte.com/Avada/5.1.4/csrf.html...

Multiple Slider Plugins for WordPress 'img' Parameter Local File Inclusion Vulnerability

A Slider plugin for WordPress hosted on the remote web server is affected by a local file inclusion vulnerability due to a failure to properly sanitize user-supplied input to the 'img' parameter of the 'imageview.class.php' script. This allows an unauthenticated, remote attacker to read arbitrary...