CVE-2024-13346

CVE-2024-13346 Avada 主题 7.11.14 - 未经认证的任意短代码执行 CVE-2024-13346 漏洞利用脚本 安装代码 root@kitploit: git clone https://github.com/tausifzaman/CVE-2024-13346.git root@kitploit: cd CVE-2024-13346 root@kitploit: pip install -r requirements.txt root@kitploit: python3 exploit.py Google Cloud Console Cloud Shell...

CVE-2026-6279

CVE-2026-6279 Avada Builder = 3.15.2 — 인증되지 않은 RCE Allowlist 없는 calluserfunc를 통한 취약점 요약 Avada Fusion Builder 테마 — 900,000+ 활성 설치 수를 자랑하는 인기 WordPress 프리미엄 테마 — 의 Avada Builder Fusion Builder 버전 = 3.15.2 에서 인증 없이 원격 코드 실행RCE 이 가능한 취약점입니다. 공격은 wpajaxnoprivfusiongetwidgetmarkup AJAX 핸들러를 악용합니다. 이 핸들...

CVE-2026-6279

╔══════════════════════════════════════════════════════════════╗ ║ CVE-2026-6279 · Avada Builder = 3.15.2 ║ ║ 인증되지 않은 calluserfunc를 통한 RCE ║ ╚══════════════════════════════════════════════════════════════╝ 📋 요약...

CVE-2026-6279.py

विवरण यह पायथन स्क्रिप्ट CVE-2026-6279 के लिए एक शोषण उपकरण है जो Avada Builder = 3.15.2 को लक्षित करता है। मुख्य व्यवहार: Avada-विशिष्ट शॉर्टकोड/पेज पैटर्न के माध्यम से fusionloadnonce के लिए लक्ष्यों को स्कैन करता है AJAX एंडपॉइंट और मूल IP बायपास की खोज करता है यदि Cloudflare admin-ajax को ब्ल...

WordPress Avada Theme <= 7.16 - Unauthenticated Remote Code Execution via Arbitrary File Write vulnerability

Unauthenticated Remote Code Execution via Arbitrary File Write vulnerability discovered by WordFence in WordPress Theme Avada versions = 7.16...

CVE-2026-18431

The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16. This is due to a chain of authorization and input validation weaknesses across the two...

EUVD-2026-66293

The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16. This is due to a chain of authorization and input validation weaknesses across the two...

CVE-2026-18431

The Avada WordPress theme (≤ 7.16) combined with the Fusion Builder plugin (≤ 3.16) is vulnerable to unauthenticated Remote Code Execution via a chain of six authorization and input validation weaknesses enabling arbitrary file write. An attacker can create and execute arbitrary PHP files, leadin...

Avada < 7.11.7 - Information Disclosure

The Avada theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.11.6 via the '/wp-content/uploads/fusion-forms/' directory. This makes it possible for unauthenticated attackers to extract sensitive data uploaded via an Avada created form with ...

Avada (Fusion) Builder <= 3.15.3 - Unauthenticated Arbitrary File Deletion

The Avada Fusion Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the maybedeletefiles function. An unauthenticated attacker can delete arbitrary files on the server by manipulating the filepath parameter in the...

Wordfence Argus Finds Complex 6 Step Critical RCE in Avada Theme with 1 Million Sales

A year ago we wrote that we'd put AI to work across the whole company, turning everyone on the team into a capable AI operator so our defenders could stay ahead of the threat actors attacking the sites we protect. In April we showed where it was heading: in the space of a few months, AI-assisted...

CVE-2022-1386-FusionBuilder-SSRF

CVE-2022-1386 – Fusion Builder Esempio: root@kitploit: python3 exploitcve20221386.py https://vulnerable.site https://abc123.oast.fun Usa Interact.sh o Burp Collaborator per ricevere il callback. 📋 Output di esempio root@kitploit: Fetching nonce from target... Sending SSRF payload to...

WordPress Fusion Builder <3.6.2 - Server-Side Request Forgery

WordPress Fusion Builder plugin before 3.6.2 is susceptible to server-side request forgery. The plugin does not validate a parameter in its forms, which can be used to initiate arbitrary HTTP requests. The data returned is then reflected back in the application's response. An attacker can...

CVE-2026-8713

CVE-2026-8713 — Avada Fusion Builder Exploit per WordPress Path Traversal non autenticato → Eliminazione arbitraria di file → Reinstallazione forzata → RCE Panoramica CVE-2026-8713 è una vulnerabilità critica con CVSS 9.1 nel plugin/tema Avada Fusion Builder per WordPress. La funzione...

CVE-2026-65524

Technical details for CVE-2026-65524 are not publicly available in the provided documents. Monitor for updates.

EUVD-2026-48125

Contributor Broken Access Control in Avada Custom Branding = 1.2 versions...

EUVD-2026-48083

Unauthenticated Cross Site Request Forgery CSRF in Avada Core = 5.15.6 versions...

CVE-2026-65471

The CVE-2026-65471 entry concerns unauthenticated Cross Site Request Forgery (CSRF) in the WordPress Avada Core plugin

CVE-2026-12536

The Avada Fusion Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Module Title’ parameter in all versions up to, and including, 3.15.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-12536

CVE-2026-12536 : A Stored Cross-Site Scripting flaw in the Avada (Fusion) Builder plugin for WordPress affects all versions up to 3.15.5. It arises from insufficient input sanitization and output escaping in the Module Title parameter. An authenticated attacker with Contributor-level access or hi...