CVE-2026-1509
published 2026-04-15CVE-2026-1509: The Avada (Fusion) Builder plugin for WordPress is vulnerable to Arbitrary WordPress Action Execution in all versions up to, and including, 3.15.1. This is due…
PriorityP335medium5.4CVSS 3.1
AVNACLPRLUINSUCLILAN
EPSS
0.31%
23.7th percentile
The Avada (Fusion) Builder plugin for WordPress is vulnerable to Arbitrary WordPress Action Execution in all versions up to, and including, 3.15.1. This is due to the plugin's `output_action_hook()` function accepting user-controlled input to trigger any registered WordPress action hook without proper authorization checks. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary WordPress action hooks via the Dynamic Data feature, potentially leading to privilege escalation, file inclusion, denial of service, or other security impacts depending on which action hooks are available in the WordPress installation.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| themefusion | avada_builder | <= 3.15.1 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-58383 gimp: gimp: Heap buffer overflow via bpp=0 infinite loop in ReadJeffsImage()
bugzilla·2026-07-06
CVE-2026-58383 [HIGH] CVE-2026-58383 gimp: gimp: Heap buffer overflow via bpp=0 infinite loop in ReadJeffsImage()
CVE-2026-58383 gimp: gimp: Heap buffer overflow via bpp=0 infinite loop in ReadJeffsImage()
Heap buffer overflow WRITE via infinite loop in GIMP's Jeff's Image Format (JIF) parser. In ReadJeffsImage() in file-gif-load.c, when bpp is 0 from the JIF header, the inner loop for (j = 0; j < 8; j += bpp) never advances and writes unboundedly past the heap buffer.
- Function: ReadJeffsImage()
- File: plug-ins/common/file-gif-load.c:1509-1635
- Fix: https://gitlab.gnome.org/GNOME/gimp/-/commit/fb63e036
- Upstream issue: https://gitlab.gnome.org/GNOME/gimp/-/issues/16213
- Acknowledgment: bb1abu
Bugzilla
CVE-2026-58382 gimp: gimp: Heap buffer overflow write in ReadJeffsImage()
bugzilla·2026-07-06
CVE-2026-58382 [HIGH] CVE-2026-58382 gimp: gimp: Heap buffer overflow write in ReadJeffsImage()
CVE-2026-58382 gimp: gimp: Heap buffer overflow write in ReadJeffsImage()
Heap buffer overflow WRITE in GIMP's Jeff's Image Format (JIF) parser. In ReadJeffsImage() in file-gif-load.c, the bpp byte from the JIF header is used without validation as the unpack step. With bpp=1, the inner loop produces 8 pixels per decompressed byte, but the output buffer is sized for 1 pixel per byte, causing an 8x heap out-of-bounds write.
- Function: ReadJeffsImage()
- File: plug-ins/common/file-gif-load.c:1509-1635
- Fix: https://gitlab.gnome.org/GNOME/gimp/-/commit/de76a604
- Upstream issue: https://gitlab.gnome.org/GNOME/gimp/-/issues/16212
- Acknowledgment: bb1abu
2026-04-15
Published