Vulnerabilities and security researches forthemify-builder themify-builder

Direction: descending

Nov 01, 2026

Themify Builder # CVE-2026-115869

CVE, Research URL: CVE-2026-115869
Home page URL: Security reports for Themify Builder
Application: Themify Builder
Date: Oct 30, 2026
Research Description: The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'variations' repeater field of Custom Font (tb_cf) posts in versions up to, and including, 7.8.4. This is due to insufficient input sanitization and output escaping on the variations post meta: Themify_Metabox::_save_meta() only passes the value through wp_kses_data() when the field type is 'textbox' or 'textarea', so the 'repeater' field writes attacker-controlled sub-fields (style, woff/woff2/ttf/svg/eot URLs) to update_post_meta() verbatim, and Themify_Custom_Fonts::render_columns() later echoes those values unescaped inside a <style> block on the Custom Fonts admin listing. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page (specifically, the Custom Fonts admin listing).
Affected versions: max 7.8.5.
Status: vulnerable

Oct 19, 2026

Themify Builder # CVE-2026-111726

CVE, Research URL: CVE-2026-111726
Home page URL: Security reports for Themify Builder
Application: Themify Builder
Date: Oct 17, 2026
Research Description: The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'visible' Shortcode Attribute in all versions up to, and including, 7.8.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the 'slider' custom post type is active, which is satisfied automatically when the plugin is paired with a Themify theme or any other plugin that registers the 'slider' CPT.
Affected versions: max 7.8.3.
Status: vulnerable

Oct 06, 2026

Themify Builder # CVE-2026-96831

CVE, Research URL: CVE-2026-96831
Home page URL: Security reports for Themify Builder
Application: Themify Builder
Date: Sep 30, 2026
Research Description: Contributor PHP Object Injection in Themify Builder <= 7.8.1 versions.
Affected versions: max 7.8.2.
Status: vulnerable

Sep 26, 2026

Themify Builder # CVE-2026-95864

CVE, Research URL: CVE-2026-95864
Home page URL: Security reports for Themify Builder
Application: Themify Builder
Date: Sep 25, 2026
Research Description: The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'css[fonts]' Parameter in all versions up to, and including, 7.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce required to reach the vulnerable endpoint is embedded in plain sight within the front-end page markup for all visitors, reducing the access control to a CSRF token rather than an authentication barrier and making the endpoint fully exploitable by unauthenticated attackers.
Affected versions: max 7.8.2.
Status: vulnerable

Aug 23, 2026

Themify Builder # CVE-2026-75027

CVE, Research URL: CVE-2026-75027
Home page URL: Security reports for Themify Builder
Application: Themify Builder
Date: Aug 22, 2026
Research Description: The Themify Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.8.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify the stored Themify Builder styling data (padding and margin properties) of arbitrary posts, including private and draft posts, by supplying an attacker-controlled post ID and JSON styling payload. The nonce required by the handler is automatically emitted to all frontend pages rendered by the builder via wp_localize_script, meaning any unauthenticated visitor can trivially retrieve a valid nonce from page source and satisfy the only access control in place.
Affected versions: max 7.8.1.
Status: vulnerable

Jul 17, 2026

Themify Builder # CVE-2026-15407

CVE, Research URL: CVE-2026-15407
Home page URL: Security reports for Themify Builder
Application: Themify Builder
Date: Jul 16, 2026
Research Description: The Themify Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.7.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite or delete the generated CSS stylesheet file of arbitrary posts, including private and draft posts owned by other users, and modify plugin-scoped font options. The required CSRF nonce (tf_nonce) is emitted on public front-end builder pages via wp_localize_script, making it trivially obtainable by any authenticated user visiting such a page.
Affected versions: max 7.7.8.
Status: vulnerable

Jul 16, 2026

Themify Builder # CVE-2026-57369

CVE, Research URL: CVE-2026-57369
Home page URL: Security reports for Themify Builder
Application: Themify Builder
Date: Jul 13, 2026
Research Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Builder themify-builder allows Reflected XSS.This issue affects Themify Builder: from n/a through <= 7.7.4.
Affected versions: max 7.7.5.
Status: vulnerable

Jul 12, 2026

Themify Builder # CVE-2026-15097

CVE, Research URL: CVE-2026-15097
Home page URL: Security reports for Themify Builder
Application: Themify Builder
Date: Jul 11, 2026
Research Description: The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'height_slider' Slider Module Field in all versions up to, and including, 7.7.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions: max 7.7.7.
Status: vulnerable

Themify Builder # CVE-2026-15096

CVE, Research URL: CVE-2026-15096
Home page URL: Security reports for Themify Builder
Application: Themify Builder
Date: Jul 11, 2026
Research Description: The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Map Module 'b_width_map' Field in all versions up to, and including, 7.7.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions: max 7.7.7.
Status: vulnerable

Jun 16, 2026

Themify Builder # 96477e74-de16-4824-85b1-f1faa5e981c5

CVE, Research URL: 96477e74-de16-4824-85b1-f1faa5e981c5
Home page URL: Security reports for Themify Builder
Application: Themify Builder
Date: -
Research Description: Themify Builder [themify-builder] < 5.3.2 Themify Builder < 5.3.2 - Reflected Cross-Site Scripting The plugin does not escape some parameters before outputting them back in attributes and tags in an admin page, leading to Reflected Cross-Site Scripting issues
Affected versions: max 5.3.2.
Status: vulnerable

Apr 25, 2026

Themify Builder # CVE-2025-9353

CVE, Research URL: CVE-2025-9353
Home page URL: Security reports for Themify Builder
Application: Themify Builder
Date: Sep 24, 2025
Research Description: The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in all versions up to, and including, 7.6.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 7.6.9.
Affected versions: max 7.7.0.
Status: vulnerable

Aug 23, 2025

Themify Builder # CVE-2025-49396

CVE, Research URL: CVE-2025-49396
Home page URL: Security reports for Themify Builder
Application: Themify Builder
Date: Aug 20, 2025
Research Description: Missing Authorization vulnerability in themifyme Themify Builder themify-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Themify Builder: from n/a through <= 7.6.7.
Affected versions: max 7.6.8.
Status: vulnerable

Jan 23, 2025

Themify Builder # CVE-2024-13319

CVE, Research URL: CVE-2024-13319
Home page URL: Security reports for Themify Builder
Application: Themify Builder
Date: Jan 22, 2025
Research Description: The Themify Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 7.6.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected versions: max 7.6.6.
Status: vulnerable

Dec 23, 2024

Themify Builder # CVE-2024-56216

CVE, Research URL: CVE-2024-56216
Home page URL: Security reports for Themify Builder
Application: Themify Builder
Date: Dec 31, 2024
Research Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themifyme Themify Builder themify-builder allows PHP Local File Inclusion.This issue affects Themify Builder: from n/a through <= 7.6.3.
Affected versions: max 7.6.5.
Status: vulnerable

Nov 16, 2024

Themify Builder # CVE-2024-52423

CVE, Research URL: CVE-2024-52423
Home page URL: Security reports for Themify Builder
Application: Themify Builder
Date: Nov 18, 2024
Research Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Builder themify-builder allows Stored XSS.This issue affects Themify Builder: from n/a through <= 7.6.5.
Affected versions: max 7.6.6.
Status: vulnerable

Oct 06, 2024

Themify Builder # CVE-2024-9385

CVE, Research URL: CVE-2024-9385
Home page URL: Security reports for Themify Builder
Application: Themify Builder
Date: Oct 05, 2024
Research Description: The Themify Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 7.6.2. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected versions: max 7.6.3.
Status: vulnerable

Aug 22, 2024

Themify Builder # CVE-2024-7836

CVE, Research URL: CVE-2024-7836
Home page URL: Security reports for Themify Builder
Application: Themify Builder
Date: Aug 22, 2024
Research Description: The Themify Builder plugin for WordPress is vulnerable to unauthorized post duplication due to missing checks on the duplicate_page_ajaxify function in all versions up to, and including, 7.6.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to duplicate and view private or draft posts created by other users that otherwise shouldn't be accessible to them.
Affected versions: max 7.6.2.
Status: vulnerable

Jun 15, 2024

Themify Builder # CVE-2024-3032

CVE, Research URL: CVE-2024-3032
Home page URL: Security reports for Themify Builder
Application: Themify Builder
Date: Jun 13, 2024
Research Description: Themify Builder WordPress plugin before 7.5.8 does not validate a parameter before redirecting the user to its value, leading to an Open Redirect issue
Affected versions: max 7.5.8.
Status: vulnerable

Jun 07, 2024

Themify Builder # CVE-2024-24872

CVE, Research URL: CVE-2024-24872
Home page URL: Security reports for Themify Builder
Application: Themify Builder
Date: Feb 21, 2024
Research Description: Cross-Site Request Forgery (CSRF) vulnerability in Themify Themify Builder.This issue affects Themify Builder: from n/a through 7.0.5.
Affected versions: max 7.0.6.
Status: vulnerable

Themify Builder # 6698970fb3222b076e45d37df7e3fb6bdae4fb73

CVE, Research URL: 6698970fb3222b076e45d37df7e3fb6bdae4fb73
Home page URL: Security reports for Themify Builder
Application: Themify Builder
Date: Oct 04, 2021
Research Description: Themify Builder [themify-builder] < 5.3.2 Themify Builder <= 5.3.1 - Reflected Cross-Site Scripting The Themify Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the multiple parameters in versions up to, and including, 5.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected versions: max 5.3.2.
Status: vulnerable