CVE-2026-115869

MediumCVSS 6.4

Published: 30/10/2026(UTC)Updated: 30/10/2026(UTC)Translated: 30/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

22th percentile - higher than 22% of all known CVEs

Summary

The Themify Builder plugin for WordPress (versions up to and including 7.8.4) is vulnerable to Stored Cross-Site Scripting via the 'variations' repeater field of Custom Font (tb_cf) posts. Insufficient input sanitization and output escaping on the variations post meta allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts that execute on the Custom Fonts admin listing.

Risk Assessment

An attacker with Contributor privileges can inject a malicious script that executes in the browser of an administrator visiting the Custom Fonts listing, potentially leading to admin session takeover.

Recommendation

Update the Themify Builder plugin to a version later than 7.8.4. Consider restricting Contributor privileges to edit Custom Fonts.

Other vulnerabilities in Themify Builder WordPress Plugin

CVE-2026-111726Medium
The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'visible' Shortcode Attribute in all versions up to, and including, 7.8.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the 'slider' custom post type is active, which is satisfied automatically when the plugin is paired with a Themify theme or any other plugin that registers the 'slider' CPT.

Original NVD description (English source)

The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'variations' repeater field of Custom Font (tb_cf) posts in versions up to, and including, 7.8.4. This is due to insufficient input sanitization and output escaping on the variations post meta: Themify_Metabox::_save_meta() only passes the value through wp_kses_data() when the field type is 'textbox' or 'textarea', so the 'repeater' field writes attacker-controlled sub-fields (style, woff/woff2/ttf/svg/eot URLs) to update_post_meta() verbatim, and Themify_Custom_Fonts::render_columns() later echoes those values unescaped inside a <style> block on the Custom Fonts admin listing. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page (specifically, the Custom Fonts admin listing).

Vulnerability data from NVD (NIST) · CISA KEV · EPSS