CVE-2022-1386

CVE-2022-1386 - Fusion Builder 3.6.2 - SSRF no autenticado Descripción Fusion Builder es un plugin de WordPress que permite a los usuarios crear y editar páginas mediante una interfaz de arrastrar y soltar. Es vulnerable a un SSRF no autenticado que permite a un atacante leer cualquier archivo de...

fubucker

Fubucker | CVE-2022-1386 - Fusion Builder Herramienta masiva automática para comprobar la vulnerabilidad en CVE-2022-1386 - Fusion Builder install.sh sha1sum install.sh | grep 12345678 md5sum install.sh sha512sum install.sh bash install.sh Instalar JQ Linux : comando apt-get install jq -y Windows...

WordPress Fusion Builder <3.6.2 - Server-Side Request Forgery

WordPress Fusion Builder plugin before 3.6.2 is susceptible to server-side request forgery. The plugin does not validate a parameter in its forms, which can be used to initiate arbitrary HTTP requests. The data returned is then reflected back in the application's response. An attacker can...

CVE-2022-1386-FusionBuilder-SSRF

CVE-2022-1386 – Fusion Builder Ejemplo: root@kitploit: python3 exploitcve20221386.py https://vulnerable.site https://abc123.oast.fun Usa Interact.sh o Burp Collaborator para recibir la devolución. 📋 Salida de ejemplo root@kitploit: Fetching nonce from target... Sending SSRF payload to...

CVE-2026-8713

CVE-2026-8713 — Exploit de Avada Fusion Builder para WordPress Path Traversal sin autenticación → Eliminación arbitraria de archivos → Reinstalación forzada → RCE Descripción general CVE-2026-8713 es una vulnerabilidad crítica con CVSS 9.1 en el plugin/tema Avada Fusion Builder para WordPress. La...

CVE-2022-1386

描述 Fusion Builder 是一个 WordPress 插件，允许用户通过拖放界面创建和编辑页面。它存在一个未认证的 SSRF 漏洞，攻击者可利用该漏洞读取服务器上的任意文件。 概念验证 请求： root@kitploit: POST /wp-admin/admin-ajax.php HTTP/1.1 Host: redacted.com User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64; rv:98.0 Gecko/20100101 Firefox/98.0 Accept-Encoding: gzip, deflate...

EUVD-2026-67409

The Avada Fusion Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'size' Shortcode Attribute in all versions up to, and including, 3.15.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-16654: Improper Neutralization of Input During Web Page Generation

The Avada Fusion Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'size' Shortcode Attribute in all versions up to, and including, 3.15.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

PT-2026-82859

The Avada Fusion Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'size' Shortcode Attribute in all versions up to, and including, 3.15.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

WordPress Avada (Fusion) Builder plugin <= 3.15.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' Shortcode Attribute vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'size' Shortcode Attribute vulnerability discovered by João Pedro Soares de Alcântara - Kinorth in WordPress Plugin Fusion Builder versions = 3.15.6...

WordPress Fusion Builder plugin <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write vulnerability

Unauthenticated Remote Code Execution via Arbitrary File Write vulnerability discovered by WordFence in WordPress Plugin Fusion Builder versions = 3.16...

CVE-2026-18431

The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16. This is due to a chain of authorization and input validation weaknesses across the two...

CVE-2026-18431 Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write

The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16. This is due to a chain of authorization and input validation weaknesses across the two...

EUVD-2026-66293

The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16. This is due to a chain of authorization and input validation weaknesses across the two...

CVE-2026-18431 Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write

The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16. This is due to a chain of authorization and input validation weaknesses across the two...

CVE-2026-18431

The Avada WordPress theme (≤ 7.16) combined with the Fusion Builder plugin (≤ 3.16) is vulnerable to unauthenticated Remote Code Execution via a chain of six authorization and input validation weaknesses enabling arbitrary file write. An attacker can create and execute arbitrary PHP files, leadin...

CVE-2026-18431: Missing Authorization

The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16. This is due to a chain of authorization and input validation weaknesses across the two...

PT-2026-81951

Name of the Vulnerable Software and Affected Versions Avada versions prior to 7.16.1 Fusion Builder versions prior to 3.16.1 Description An unauthenticated attacker can achieve remote code execution and complete site compromise by writing attacker-controlled PHP files to the server. This is...

Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write

Description The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16. This is due to a chain of authorization and input validation weaknesses across...

CVE-2026-12536

The Avada Fusion Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Module Title’ parameter in all versions up to, and including, 3.15.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...