Themify Builder EUVD-2026-43139

Exploitation requires an authenticated WordPress user account with at minimum contributor-level access (PR:L confirmed by CVSS vector). The Themify Builder plugin must be installed and active on the target site. The specific vulnerable component is the Map Module, and the injection point is the b_width_map field within that module. The attacker must have the ability to create or edit pages using the Themify Builder interface - a capability granted to contributors by default in WordPress. What limits exploitation: sites with no contributor-level (or higher) accounts beyond administrators are not practically exploitable; sites with closed user registration and tightly controlled roles face a high barrier; the attack is limited to the Map Module specifically and does not apply to other builder modules. There is no network-level blocking that prevents exploitation since the attack vector is a standard authenticated HTTP POST to the WordPress admin interface.

The CVSS 3.1 score of 6.4 (Medium) is derived from AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. The PR:L metric correctly reflects the contributor-level authentication barrier, which is the primary limiting factor on real-world risk. On WordPress sites with closed registration or tightly controlled contributor roles, exploitation is difficult. However, many WordPress deployments allow open or semi-open registration, or maintain a large pool of contributors, which lowers the practical barrier significantly. The S:C (Scope Changed) metric captures the cross-context nature of stored XSS - impact falls on the victim's browser, not the server - and UI:N is standard for stored XSS where victim page-load constitutes automatic execution. No EPSS data was provided in the intelligence sources, and the vulnerability is absent from CISA KEV. No POC has been referenced. Taken together, real-world priority is moderate: sites with many contributor accounts or open registration should treat this as urgent; sites with tightly controlled user roles have substantially lower exposure. The authentication requirement is the key differentiator from a critical rating.

An attacker registers or compromises a contributor-level WordPress account on a site running Themify Builder 7.7.6 or earlier, then uses the builder interface to create or edit a page containing a Map Module, injecting a JavaScript payload such as a cookie-stealing script into the b_width_map field. Once the page is published, every subsequent visitor - including administrators - who loads the page will have the script execute in their browser, potentially exfiltrating their session cookie to an attacker-controlled endpoint and enabling full account takeover of high-privileged users.