How many ThemeFusion Fusion Builder CVEs are in CISA KEV?

None of ThemeFusion Fusion Builder's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which versions of ThemeFusion Fusion Builder are affected?

22 distinct ThemeFusion Fusion Builder versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in ThemeFusion Fusion Builder CVEs?

ThemeFusion Fusion Builder's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-862 (Missing Authorization), CWE-352 (Cross-Site Request Forgery (CSRF)), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')).

How many critical ThemeFusion Fusion Builder vulnerabilities are there?

ThemeFusion Fusion Builder has 1 critical and 6 high-severity CVEs.

What is the average severity of ThemeFusion Fusion Builder CVEs?

The average CVSS base score across ThemeFusion Fusion Builder's scored CVEs is 7.4.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

ThemeFusion

12 CVEs

ThemeFusion Fusion Builder Vulnerabilities

Name: ThemeFusion Fusion Builder vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for Fusion Builder by ThemeFusion.

12

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

0

Public exploits

PoC or exploit code

7.4

Avg CVSS

2024–2026

Last updated June 26, 2026

Overview

ThemeFusion Fusion Builder has 12 published CVE records since 2024, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 0 have a known public exploit. The average CVSS base score across scored CVEs is 7.4.

This page aggregates every publicly disclosed vulnerability (CVE) affecting ThemeFusion Fusion Builder, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list.

Severity and exploitation

How the CVSS severity of ThemeFusion Fusion Builder's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical1

High6

Medium5

Low0

In CISA’s Known Exploited Vulnerabilities catalog

0

None of ThemeFusion Fusion Builder's CVEs are currently listed in CISA's KEV catalog.

Public exploits

0

No ThemeFusion Fusion Builder CVEs currently have a tracked public exploit.

Affected versions and CVEs

Browse every ThemeFusion Fusion Builder version named in a CVE, then pick one to see only the CVEs that affect it.

Version ranges

<= 3.11.14 CVEs
>= 3.11.24 CVEs
<= 3.15.43 CVEs
>= 3.15.03 CVEs
>= 3.15.53 CVEs
<= 3.15.02 CVEs
< 3.15.01 CVE
<= 3.13.21 CVE
<= 3.14.11 CVE
>= 3.13.31 CVE
>= 3.14.21 CVE

Fixed in

> 3.11.14 CVEs
3.11.24 CVEs
> 3.15.43 CVEs
3.15.03 CVEs
3.15.53 CVEs
> 3.15.02 CVEs
> < 3.15.01 CVE
> 3.13.21 CVE
> 3.14.11 CVE
3.13.31 CVE
3.14.21 CVE

Find a version

12 CVEs

Sort

WordPress Fusion Builder plugin <= 3.15.4 - Privilege Escalation vulnerability
CVE-2026-56008
Patch
CWE-266
High · CVSS 8.8
EPSS 0.3% (20th pct)2026-06-26
WordPress Fusion Builder plugin <= 3.15.4 - Arbitrary File Deletion vulnerability
CVE-2026-54193
Patch
CWE-22
High · CVSS 7.7
EPSS 0.3% (25th pct)2026-06-17
WordPress Fusion Builder plugin <= 3.15.4 - PHP Object Injection vulnerability
CVE-2026-54194
Patch
CWE-502
Critical · CVSS 9.8
EPSS 0.4% (30th pct)2026-06-16
WordPress Fusion Builder plugin < 3.15.0 - Reflected Cross Site Scripting (XSS) vulnerability
CVE-2026-32542
Patch
CWE-79
High · CVSS 7.1
EPSS 0.1% (4th pct)2026-03-25
WordPress Fusion Builder plugin < 3.15.0 - Broken Access Control vulnerability
CVE-2026-32452
Patch
CWE-862
Medium · CVSS 5.3
EPSS 0.2% (8th pct)2026-03-13
WordPress Fusion Builder plugin < 3.15.0 - Broken Access Control vulnerability
CVE-2026-32451
Patch
CWE-862
Medium · CVSS 6.5
EPSS 0.2% (5th pct)2026-03-13
WordPress Fusion Builder plugin <= 3.14.1 - Cross Site Scripting (XSS) vulnerability
CVE-2026-25472
Patch
CWE-79
Medium · CVSS 6.5
EPSS 0.1% (3th pct)2026-02-19
WordPress Fusion Builder plugin <= 3.13.2 - Cross Site Scripting (XSS) vulnerability
CVE-2025-49940
Patch
CWE-79
Medium · CVSS 6.5
EPSS 0.2% (10th pct)2025-10-22
WordPress Avada Builder plugin <= 3.11.1 - Authenticated Broken Access Control vulnerability
CVE-2023-39310
Patch
CWE-862
Medium · CVSS 5.4
EPSS 0.4% (31th pct)2024-06-19
WordPress Avada Builder plugin <= 3.11.1 - Auth. SQL Injection vulnerability
CVE-2023-39309
Patch
CWE-89
High · CVSS 8.8
EPSS 0.6% (44th pct)2024-03-28
WordPress Avada Builder plugin <= 3.11.1 - Cross Site Request Forgery (CSRF) vulnerability
CVE-2023-39311
Patch
CWE-352
High · CVSS 8.8
EPSS 0.2% (13th pct)2024-03-27
WordPress Avada Builder plugin <= 3.11.1 - Reflected Cross Site Scripting (XSS) vulnerability
CVE-2023-39306
Patch
CWE-79
High · CVSS 7.1
EPSS 0.3% (26th pct)2024-03-27

Common weakness types

The CWE weakness categories most often found in ThemeFusion Fusion Builder CVEs. Follow any weakness for its full explanation.

Disclosure activity by year

How many ThemeFusion Fusion Builder CVEs were published each year.

2024

4

2025

1

2026

7

Other ThemeFusion products

Browse vulnerabilities for other products by ThemeFusion.

avada22 CVEs Avada (Fusion) Builder14 CVEs Avada | Website Builder For WordPress & WooCommerce8 CVEs avada builder4 CVEs Avada Core2 CVEs Avada Custom Branding1 CVEs Avada (premium WordPress theme)1 CVEs

All ThemeFusion vulnerabilities

Frequently asked questions

Common questions about ThemeFusion Fusion Builder vulnerabilities.

How many CVEs does ThemeFusion Fusion Builder have?: ThemeFusion Fusion Builder has 12 published CVE records since 2024.
How many ThemeFusion Fusion Builder CVEs are in CISA KEV?: None of ThemeFusion Fusion Builder's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Are there public exploits for ThemeFusion Fusion Builder vulnerabilities?: No ThemeFusion Fusion Builder CVEs currently have a tracked public exploit in this dataset.
Which versions of ThemeFusion Fusion Builder are affected?: 22 distinct ThemeFusion Fusion Builder versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in ThemeFusion Fusion Builder CVEs?: ThemeFusion Fusion Builder's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-862 (Missing Authorization), CWE-352 (Cross-Site Request Forgery (CSRF)), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')).
How many critical ThemeFusion Fusion Builder vulnerabilities are there?: ThemeFusion Fusion Builder has 1 critical and 6 high-severity CVEs.
What is the average severity of ThemeFusion Fusion Builder CVEs?: The average CVSS base score across ThemeFusion Fusion Builder's scored CVEs is 7.4.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track ThemeFusion Fusion Builder vulnerabilities

Monitor new ThemeFusion Fusion Builder vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing