EUVD-2026-43443Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Network-reachable reflected XSS needs a victim click (UI:R) and no attacker auth (PR:N); script runs cross-context (S:C) with limited C/I/A impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Builder themify-builder allows Reflected XSS.This issue affects Themify Builder: from n/a through <= 7.7.4.
AnalysisAI
Reflected cross-site scripting in the Themify Builder WordPress plugin (versions up to and including 7.7.4) lets remote attackers inject arbitrary script that executes in a victim's browser when they follow a crafted link. The CVSS 3.1 base score of 7.1 reflects unauthenticated exploitation with a scope change, though it requires user interaction. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Technical ContextAI
Themify Builder is a drag-and-drop page-builder plugin for WordPress used to construct page layouts and content modules. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a reflected variant: user-controllable input is echoed back into an HTTP response (typically a page parameter, search field, or builder request) without proper output encoding or sanitization, so the browser interprets attacker-supplied markup as executable script. The affected CPE is cpe:2.3:a:themifyme:themify_builder:*:*:*:*:*:*:*:*, covering all releases through 7.7.4. Reflected XSS differs from stored XSS in that the payload is not persisted server-side but delivered per-request, meaning exploitation hinges on luring a victim to a malicious URL.
RemediationAI
No vendor-released patch version was identified in the available data; the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/themify-builder/vulnerability/wordpress-themify-builder-plugin-7-7-4-cross-site-scripting-xss-vulnerability) lists the flaw as affecting through 7.7.4, so administrators should monitor for and apply a release later than 7.7.4 once published and confirm via the Themify changelog. As compensating controls until a fix is confirmed, deploy a WordPress-aware WAF or Patchstack's virtual patching to filter reflected XSS payloads on plugin request parameters (trade-off: rule tuning may cause false positives on legitimate builder requests), restrict access to builder/preview endpoints to authenticated editors where feasible, and consider a Content-Security-Policy header disallowing inline script to blunt payload execution (trade-off: strict CSP can break themes or page-builder inline scripts and requires testing). Because this is reflected XSS, user awareness against clicking untrusted links pointing at the site also reduces exposure.
More in Themify Builder
View allStored XSS in the Themify Builder WordPress plugin (all versions through 7.7.6) allows contributor-level authenticated u
Stored Cross-Site Scripting in the Themify Builder WordPress plugin (all versions through 7.7.6) enables authenticated a
Unauthenticated styling data manipulation in the Themify Builder WordPress plugin (all versions through 7.8.0) allows an
Authorization bypass in the Themify Builder WordPress plugin (all versions through 7.7.7) permits any authenticated subs
The Themify Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today