CVE-2024-13346 affects the Avada | Website Builder For WordPress & WooCommerce theme, allowing arbitrary shortcode execution in versions up to 7.11.13. This critical vulnerability (CVSS 9.8) stems from improper validation of user-supplied values before shortcode execution, enabling unauthenticated attackers to execute arbitrary shortcodes. While no active exploitation, public exploit code, or significant community discussion has been observed, its high severity and ease of exploitation warrant immediate patching.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 7.11.14CPE matchmatch criteria | cpe:2.3:a:theme-fusion:avada:*:*:*:*:*:wordpress:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.