Themify Builder CVE-2026-115869

Requires an authenticated WordPress account at contributor level or above on a site running Themify Builder <= 7.8.4. The attacker must create or edit a Custom Font (tb_cf) post and inject payload into the 'variations' repeater field's sub-fields (style, or woff/woff2/ttf/svg/eot URL values) - these bypass the wp_kses_data() sanitization that is only applied to 'textbox'/'textarea' field types. Execution is gated on a second user (typically an administrator) subsequently visiting the Custom Fonts admin listing page where render_columns() echoes the value unescaped inside a <style> block. Limiting factors: contributor-level authentication is mandatory (not exploitable anonymously), the payload only fires when a privileged user browses the specific admin listing, and the plugin must be installed and active.

This is a moderate-severity stored XSS (CVSS 6.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) whose real-world priority is bounded by its authentication requirement. The vector's AV:N/AC:L/UI:N signals a low-friction network-reachable flaw, but PR:L is the decisive limiter: exploitation requires an authenticated contributor-level (or higher) account, so this is not a mass-exploitable unauthenticated bug. The scope change (S:C) and C:L/I:L reflect the classic XSS pattern where a low-privileged author injects script that executes in a higher-privileged admin's browser session, enabling privilege escalation toward full site takeover - the reason stored XSS in WordPress plugins is treated seriously despite modest base scores. No EPSS score and no KEV status were supplied in the input, and the Decision label is 'this_month' (not act_now/emergency), which is consistent with a patch-this-cycle rather than drop-everything posture. No public exploit code or PoC reference is present among the sources (only Wordfence threat intel, plugin source lines, and the fix changeset), so there is no evidence of active exploitation or available weaponization. Net: a legitimate issue to remediate within the normal cycle on sites that grant contributor access to untrusted users, but low urgency on sites where all authors are trusted.

An attacker who holds (or phishes/registers for) a contributor-level account creates or edits a Custom Font (tb_cf) post and places a JavaScript payload inside a 'variations' repeater sub-field (e.g., the style or font-file URL values), which is written to post meta without sanitization. When an administrator later opens the Custom Fonts admin listing, the stored payload is echoed unescaped inside a <style> block and executes in the admin's authenticated session, allowing session/account actions on their behalf. No public exploit identified at time of analysis.