CVE WATCH / VULNERABILITY DETAIL
CVE-2026-115346
HIGHCVSS 8.1NVD feed
Published 30 October 2026 · tracked since 31 October 2026
Description
The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 7.16.2 via the convert_palette_images_to_truecolor() function. This is due to insufficient file type validation before processing uploaded files. This
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-16760 HIGH 8.8
- CVE-2026-118938 HIGH 8.8
- CVE-2026-111578 HIGH 7.5
- CVE-2026-62990 HIGH 8.7
- CVE-2026-62989 HIGH 8.1
- CVE-2026-62864 HIGH 7.5
- CVE-2026-62958 HIGH 7.9
- CVE-2026-62297 HIGH 7.5
- CVE-2026-62847 HIGH 8.2
- CVE-2026-58412 HIGH 8.2