CVE-2022-41996

HIGH 8.8CVE-2022-41996 · Published 27/10/2022 · updated 17/06/2026

In short

CVE-2022-41996 is a HIGH (CVSS 8.8) vulnerability affecting avada (theme-fusion).
Chance of exploitation in the next 30 days (EPSS): 0.60%, higher than 48.4% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
avada theme-fusion	`≤ 7.8.1`	No fix yet

Description

Cross-Site Request Forgery (CSRF) vulnerability in ThemeFusion Avada premium theme versions <= 7.8.1 on WordPress leading to arbitrary plugin installation/activation.

References

patchstack.com/database/vulnerability/avada/wordpress-avada-premium-theme-7-8-1-cross-site-request-forgery-csrf-vulnerability · Third Party Advisory
theme-fusion.com/documentation-assets/avada/changelog.txt · Release Notes
themeforest.net/item/avada-responsive-multipurpose-theme/2833226 · Product

More vulnerabilities in avada

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

avada

theme-fusion

≤ 7.8.1

No fix yet

More vulnerabilities in avada

See all →