EUVD-2026-86580
GHSA-h25g-w4w9-f766
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Nonce is publicly exposed in markup so PR:N; stored XSS crosses into the visitor's browser (S:C) with partial confidentiality/integrity impact and no availability effect.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'css[fonts]' Parameter in all versions up to, and including, 7.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce required to reach the vulnerable endpoint is embedded in plain sight within the front-end page markup for all visitors, reducing the access control to a CSRF token rather than an authentication barrier and making the endpoint fully exploitable by unauthenticated attackers.
Articles & Coverage 1
AnalysisAI
Stored cross-site scripting in the Themify Builder plugin for WordPress, affecting all versions up to and including 7.8.1, allows unauthenticated attackers to inject arbitrary JavaScript through the css[fonts] parameter; the payload is persisted in site styling and executes in the browser of any visitor who later views the affected page. The assessed CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, score 7.2) confirms this is a network-reachable, unauthenticated attack requiring no victim interaction to plant the payload, with scope change because the injected content escapes the plugin's own security boundary into site pages. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitable against default configurations of any site running Themify Builder <=7.8.1 where the vulnerable styling endpoint is reachable and the front-end pages expose the nonce in markup (the described default behavior). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but moderate-severity issue rather than an emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | An upstream fix for this issue exists in the plugin's Trac repository as changeset 3710320 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3710320%40themify-builder&new=3710320%40themify-builder), so the primary action is to update Themify Builder to the first release containing that changeset; the exact patched version number is not independently confirmed in the provided data, so verify the installed version against the changelog and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/fc021ee6-694a-426b-b399-8dd015fd99d2?source=cve before assuming remediation. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within the first 24 hours, inventory every WordPress instance running Themify Builder at or below version 7.8.1 and deactivate the plugin on any site that does not absolutely require it, or, where it is business-critical, place the affected sites behind a WAF rule that blocks or sanitizes requests carrying the css[fonts] parameter; simultaneously run an immediate content scan of stored styling and theme/page post metadata for injected script tags or obfuscated JavaScript, back up current databases for forensic comparison, and notify the web operations and communications owners that the plugin is unpatched. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Themify Builder
View allAuthenticated Contributor-level users can exploit a PHP Object Injection vulnerability in Themify Builder versions up to
Reflected cross-site scripting in the Themify Builder WordPress plugin (versions up to and including 7.7.4) lets remote
Stored XSS in the Themify Builder WordPress plugin (all versions through 7.7.6) allows contributor-level authenticated u
Stored Cross-Site Scripting in the Themify Builder WordPress plugin (all versions through 7.7.6) enables authenticated a
Unauthenticated styling data manipulation in the Themify Builder WordPress plugin (all versions through 7.8.0) allows an
Authorization bypass in the Themify Builder WordPress plugin (all versions through 7.7.7) permits any authenticated subs
The Themify Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today