Themify Builder EUVD-2026-103229

Exploitation requires an authenticated WordPress account with contributor-level capability or higher (per PR:L) and the 'slider' custom post type to be registered and active - the description states this is satisfied automatically when Themify Builder is paired with a Themify theme or any other plugin that registers the 'slider' CPT. The vulnerable sink is the 'visible' attribute of the slider shortcode, which lacks input sanitization and output escaping. Limiting factors: the attacker cannot be fully anonymous (contributor account needed), the stored payload only triggers when another user accesses the injected page, and the slider CPT must be present - in a bare Themify Builder install without a slider-registering theme/plugin the vector is not reachable.

This is a genuine but moderate-priority issue, not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, base 6.4) indicates a network-reachable stored XSS requiring only low (contributor-level) privileges, with a scope change reflecting script execution in other users' browser contexts and limited confidentiality/integrity impact. No EPSS score, KEV listing, or POC was supplied in the input, so exploitation status is 'no public exploit identified at time of analysis' - absence of these signals is not proof of safety but does argue against widespread automated exploitation today. The practical risk is tempered by two real gatekeepers: the attacker must already hold an authenticated contributor account (PR:L), and exploitation is only possible when the 'slider' custom post type is registered, which the description notes happens automatically with a Themify theme or compatible plugin. SSVC-style reasoning: exploitation is not automatable (needs a valid low-priv account and a specific CPT condition) and technical impact is partial, so this reads as a classic authenticated multi-user WordPress XSS rather than a drive-by threat. No signals conflict; the main caveat is simply that EPSS/KEV/POC data were not provided and should be re-checked before final triage.

An attacker with a contributor-level WordPress account (self-registered or compromised) crafts content using the Themify Builder slider shortcode and injects a malicious payload into the unsanitized 'visible' attribute. When a higher-privileged user such as an editor or administrator previews or opens the resulting page, the stored script executes in their authenticated browser session, enabling session/cookie theft or actions on their behalf. No public POC was provided in the input, and successful exploitation depends on the 'slider' custom post type being active.