24h | 7d | 30d

CVE-2026-18431

Overview

  • themefusion
  • Avada (Fusion) Builder
26 Aug 2026
Published
27 Aug 2026
Updated
CVSS v3.1
CRITICAL (9.8)
EPSS
0.64%
KEV

Description

The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16. This is due to a chain of authorization and input validation weaknesses across the two components that makes it possible for unauthenticated attackers to write attacker-controlled files to the server. This can be used to create and execute arbitrary PHP files, resulting in remote code execution and complete site compromise. Successful exploitation requires both Avada and Fusion Builder to be installed and active, as well as certain administrator-authored content to be present.

Statistics

  • 1 Post
Last activity: 3 hours ago

Fediverse

Profile picture fallback
🛡️ #1 hacks.gr @hacksgr

Wordfence and Patchstack report five vulnerabilities in WordPress products: WPMU DEV Dashboard (CVE-2026-76581), Avada/Fusion Builder (CVE-2026-18431), TranslatePress (CVE-2026-19632), Pods (CVE-2026-19598) and GiveWP (CVE-2026-82222).

Scores range from CVSS 9.8 to 10.0.

Depending on the affected version and configuration, the flaws can enable authentication bypass, administrator takeover, file creation or command execution on the serve…

en.hacks.gr/synagermos-sto-wor

#WordPress #Vulnerability #CVE

  • 0
  • 0
  • 0
  • 3h ago

CVE-2026-82222

Overview

  • Liquid Web / StellarWP
  • GiveWP
  • give
28 Aug 2026
Published
28 Aug 2026
Updated
CVSS v3.1
CRITICAL (10.0)
EPSS
0.42%
KEV

Description

Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP GiveWP allows Object Injection. This issue affects GiveWP: from n/a through 4.16.7.1.

Statistics

  • 1 Post
Last activity: 3 hours ago

Fediverse

Profile picture fallback
🛡️ #1 hacks.gr @hacksgr

Wordfence and Patchstack report five vulnerabilities in WordPress products: WPMU DEV Dashboard (CVE-2026-76581), Avada/Fusion Builder (CVE-2026-18431), TranslatePress (CVE-2026-19632), Pods (CVE-2026-19598) and GiveWP (CVE-2026-82222).

Scores range from CVSS 9.8 to 10.0.

Depending on the affected version and configuration, the flaws can enable authentication bypass, administrator takeover, file creation or command execution on the serve…

en.hacks.gr/synagermos-sto-wor

#WordPress #Vulnerability #CVE

  • 0
  • 0
  • 0
  • 3h ago
Showing 41 to 42 of 42 CVEs