What is the CVSS score of CVE-2026-15097?

CVE-2026-15097 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Themify Builder CVE-2026-15097

EUVD-2026-43132 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-11 Wordfence

GHSA-r6f8-v3hv-xx2m

WordPress XSS Themify Builder Wordpress Plugin Themifyme

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

6.4 MEDIUM

Network-accessible WordPress endpoint, low complexity, contributor auth required (PR:L), scope changes to victim browser; no availability impact from stored XSS.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 11, 2026 - 05:08 vuln.today

CVE Published

Jul 11, 2026 - 03:44 cve.org

MEDIUM 6.4

DescriptionCVE.org

The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'height_slider' Slider Module Field in all versions up to, and including, 7.7.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored XSS in the Themify Builder WordPress plugin (all versions through 7.7.6) allows contributor-level authenticated users to inject persistent JavaScript via the 'height_slider' Slider Module field, which executes in the browser of any visitor who loads an injected page. The scope change (S:C in CVSS) captures the cross-context impact: attacker payload runs in victims' sessions, enabling session hijacking, credential theft, or unauthorized admin actions. No active exploitation is confirmed in CISA KEV, but a patch commit (changeset 3601964) is visible in the WordPress plugin SVN repository, suggesting a fix has been committed beyond version 7.7.6.

Technical ContextAI

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS). The affected product is the Themify Builder page-builder plugin for WordPress (CPE: cpe:2.3:a:themifyme:themify_builder:*:*:*:*:*:*:*:*). Source references identify the flaw across multiple plugin files: the height_slider field value is accepted without adequate sanitization in class-builder-data-manager.php (lines 154 and 402) and class-themify-builder-active.php (line 559), then rendered without output escaping in template-slider.php (line 107). The root cause is a failure to apply WordPress sanitization functions (e.g., sanitize_text_field, absint) at input and escaping functions (e.g., esc_attr, esc_html) at output for the slider height parameter, allowing raw script content to persist in the database and execute on page render.

RemediationAI

Update the Themify Builder plugin to a version beyond 7.7.6 immediately. A patch commit is confirmed in the WordPress plugin SVN repository at changeset 3601964 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3601964%40themify-builder&new=3601964%40themify-builder); however, the exact released plugin version number containing this fix is not independently confirmed from the available data - verify the current version in the WordPress Plugin Directory before updating. As an interim compensating control, audit and restrict contributor-level role assignments to only fully trusted users, since exploitation requires at minimum contributor access; this reduces the attacker pool but does not eliminate the vulnerability. Site administrators may also temporarily disable the Slider Module within Themify Builder if it is not actively in use, removing the injection surface entirely. Consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/03721b29-7b26-4166-bba1-81614b412a09?source=cve for the latest patch and timeline details.