Skip to content
~/pwn.watch_

Get notified

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Only used for pwn.watch incident emails. Protected by Cloudflare Turnstile.

Become a sponsor

One slot: pwn.watch, gifs.so, flavors.design, kitze.io, every kitze repo, and an X shout-out.

YearlyMonthly

Secure checkout on Polar. Right after paying you set up your ad on kitze.io.

Avada

Security incidents tagged Avada. Newest first.

1 Avada incident in the last 12 months

Critical 4 · High 3 · Med 2 · Low 1 · Update ½LessMore
Incidents
1
Live
1
Patched
1
Days without an incident
3
Longest quiet run: 2 days (Oct 28–Oct 29)
All tags →
  • Patched

    Avada WordPress theme unauthenticated file upload to RCE via Avada Forms (CVE-2026-115346), fixed in 7.16.4

    The Avada Website Builder theme for WordPress and WooCommerce (ThemeFusion) lets unauthenticated attackers upload files that may be executable through Avada Forms upload fields, making remote code execution possible (CVE-2026-115346, CVSS 3.1 8.1 high). Wordfence, which reported it, says all versions up to and including 7.16.2 are affected because convert_palette_images_to_truecolor() does not validate file types well enough before processing uploads. Avada fixed the "possible remote code execution vulnerability in Avada Forms upload fields" in Avada Classic 7.16.4 on October 27; the CVE record was published October 30. No exploitation has been reported so far.

    Avada Website Builder theme for WordPress & WooCommerce (ThemeFusion)Since Oct 27, 2026

Sponsored

Buy sponsor slot