Themify Builder CVE-2026-15097

Exploitation requires an authenticated WordPress session with contributor-level privileges or higher (editor, administrator). The attacker must be able to create or edit pages or posts using the Themify Builder plugin's Slider Module - the height_slider field within that module is the specific injection vector. Sites where contributor registration is open or poorly controlled face the highest risk. Exploitation is bounded by the authentication requirement: unauthenticated visitors and subscriber-level users cannot trigger the stored injection. Payload execution additionally requires a subsequent victim to load the affected page, though this imposes no further constraint on the attacker after initial injection. Non-default configurations that remove contributor create/edit permissions would limit exploitability.

The CVSS 6.4 score (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) reflects the meaningful but bounded nature of this flaw. Scope:Changed (S:C) elevates the score because injected scripts cross the security boundary into victim browsers, which is the defining characteristic of XSS. However, PR:L constrains real-world risk significantly: an attacker must hold at minimum contributor-level credentials on the target site, ruling out unauthenticated mass exploitation. The attack complexity is genuinely low once access is obtained. No EPSS score was provided in the source data, so exploitation probability cannot be quantified numerically. KEV status is absent, meaning active exploitation is unconfirmed. No standalone public POC is referenced. The practical risk is highest in multi-author WordPress environments with open or weakly controlled contributor registration - single-author or tightly managed sites face substantially reduced exposure. The CVSS UI:N metric is correct from the attacker's perspective (they need no further interaction after injecting the payload), though victim page-visit is required for payload execution.

An attacker who has registered or compromised a contributor-level WordPress account on a site running Themify Builder ≤7.7.6 creates or edits a page containing a Slider module and injects a JavaScript payload (e.g., a cookie-stealing script) into the height_slider field. The payload is stored in the database and silently executes in the browser of every visitor - including administrators - who subsequently loads that page, allowing the attacker to harvest session tokens without any further interaction.