Cpe:2.3:a:theme-Fusion:avada:*:*:*:*:*:wordpress:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3atheme-fusionavadawordpress/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 29 Oct 2026 14:37:50 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgTheme-fusion Avada: Unauthenticated arbitrary shortcode execution (CVE-2024-13346)https://feed.craftedsignal.io/briefs/2026-10-avada-theme-rce/Thu, 29 Oct 2026 14:37:50 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-avada-theme-rce/CVE-2024-13346 affects Theme-fusion Avada versions prior to 7.11.14, allowing unauthenticated arbitrary shortcode execution. A public exploit is available.<p>CVE-2024-13346 allows unauthenticated arbitrary shortcode execution in Theme-fusion Avada versions prior to 7.11.14. A public exploit or PoC has been published on Sploitus. The vulnerability has a CVSS score of 9.8 and an EPSS score of 2.3%.</p> criticaladvisory