Themify Builder
Monthly
Authenticated Contributor-level users can exploit a PHP Object Injection vulnerability in Themify Builder versions up to and including 7.8.1. The flaw, caused by unsafe deserialization (CWE-502), allows an attacker with a Contributor account to inject a serialized PHP object, potentially leading to remote code execution or full site compromise if a usable PHP gadget chain exists in the WordPress installation. The vendor-assigned CVSS score is 8.8 (High), and no public exploit code has been identified at the time of analysis.
Stored cross-site scripting in the Themify Builder plugin for WordPress, affecting all versions up to and including 7.8.1, allows unauthenticated attackers to inject arbitrary JavaScript through the css[fonts] parameter; the payload is persisted in site styling and executes in the browser of any visitor who later views the affected page. The assessed CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, score 7.2) confirms this is a network-reachable, unauthenticated attack requiring no victim interaction to plant the payload, with scope change because the injected content escapes the plugin's own security boundary into site pages. The intended nonce protection is ineffective: the nonce is embedded in plain sight in front-end page markup for all visitors, so it functions only as a publicly readable CSRF token rather than an authentication barrier; no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
Reflected cross-site scripting in the Themify Builder WordPress plugin (versions up to and including 7.7.4) lets remote attackers inject arbitrary script that executes in a victim's browser when they follow a crafted link. The CVSS 3.1 base score of 7.1 reflects unauthenticated exploitation with a scope change, though it requires user interaction. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Stored cross-site scripting in the Themify Builder WordPress plugin affects all versions up to and including 7.8.4: authenticated users holding contributor-level access or higher can write arbitrary markup into the 'variations' repeater sub-fields (style, or the woff/woff2/ttf/svg/eot URL values) of a Custom Font (tb_cf) post, because Themify_Metabox::_save_meta() only applies wp_kses_data() when the field type is 'textbox' or 'textarea' and stores repeater values through update_post_meta() unfiltered. The injected content is later echoed without escaping by Themify_Custom_Fonts::render_columns() inside a <style> block on the Custom Fonts admin listing, so the script runs when a privileged user (typically an administrator) opens that page. The CVSS 3.1 score is 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), and no public exploit was identified at time of analysis; real-world priority is bounded by the mandatory contributor-level account, the need for the plugin to be active, and the requirement that a second, higher-privileged user visit the specific admin listing.
Stored cross-site scripting in the Themify Builder plugin for WordPress (all versions through 7.8.2) allows an authenticated attacker holding a contributor-level account or above to inject arbitrary JavaScript through the 'visible' attribute of the slider shortcode, which is then persisted and executed in the browser of any user who views the injected page. The payload survives in post content because the attribute is neither sanitized on input nor escaped on output, and it is only reachable when the 'slider' custom post type is registered - normally satisfied automatically by a Themify theme or any other plugin that registers that CPT. Exploitation is not anonymous (CVSS PR:L) and requires a victim to load the poisoned page; no public exploit code or confirmed in-the-wild activity was identified at time of analysis, and the issue rates as a moderate-priority stored-XSS rather than an emergency.
Unauthenticated styling data manipulation in the Themify Builder WordPress plugin (all versions through 7.8.0) allows any visitor to overwrite padding and margin properties on arbitrary posts, including private and draft content. The root cause is CWE-862 (missing authorization): the AJAX handler performing style writes relies solely on a WordPress nonce for access control, but that nonce is automatically broadcast to every frontend page via wp_localize_script, making it freely retrievable by any anonymous visitor. The CVSS score of 5.3 (AV:N/AC:L/PR:N/UI:N) is consistent with trivial unauthenticated network exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low exploitation complexity makes opportunistic abuse realistic.
Authorization bypass in the Themify Builder WordPress plugin (all versions through 7.7.7) permits any authenticated subscriber-level user to overwrite or delete CSS stylesheet files for arbitrary posts - including private and draft posts owned by other users - and modify plugin-scoped font options site-wide. The CSRF nonce (tf_nonce) nominally required to gate these actions is broadcast to every authenticated user visiting any public front-end builder page via wp_localize_script, making it trivially collectible and rendering it ineffective as a security control. No active exploitation is confirmed (not in CISA KEV) and no public exploit has been identified at time of analysis.
Stored Cross-Site Scripting in the Themify Builder WordPress plugin (all versions through 7.7.6) enables authenticated attackers holding contributor-level access or higher to persist arbitrary JavaScript via the Map Module's `b_width_map` field. Because the scope changes (S:C in CVSS), the injected payload executes inside every subsequent visitor's browser context - enabling session hijacking, credential theft, or administrative account takeover against any user who views an affected page. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, but the low exploitation complexity and network-accessible attack surface make it a meaningful risk on sites with open or broad contributor registration.
Stored XSS in the Themify Builder WordPress plugin (all versions through 7.7.6) allows contributor-level authenticated users to inject persistent JavaScript via the 'height_slider' Slider Module field, which executes in the browser of any visitor who loads an injected page. The scope change (S:C in CVSS) captures the cross-context impact: attacker payload runs in victims' sessions, enabling session hijacking, credential theft, or unauthorized admin actions. No active exploitation is confirmed in CISA KEV, but a patch commit (changeset 3601964) is visible in the WordPress plugin SVN repository, suggesting a fix has been committed beyond version 7.7.6.
The Themify Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including,. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Authenticated Contributor-level users can exploit a PHP Object Injection vulnerability in Themify Builder versions up to and including 7.8.1. The flaw, caused by unsafe deserialization (CWE-502), allows an attacker with a Contributor account to inject a serialized PHP object, potentially leading to remote code execution or full site compromise if a usable PHP gadget chain exists in the WordPress installation. The vendor-assigned CVSS score is 8.8 (High), and no public exploit code has been identified at the time of analysis.
Stored cross-site scripting in the Themify Builder plugin for WordPress, affecting all versions up to and including 7.8.1, allows unauthenticated attackers to inject arbitrary JavaScript through the css[fonts] parameter; the payload is persisted in site styling and executes in the browser of any visitor who later views the affected page. The assessed CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, score 7.2) confirms this is a network-reachable, unauthenticated attack requiring no victim interaction to plant the payload, with scope change because the injected content escapes the plugin's own security boundary into site pages. The intended nonce protection is ineffective: the nonce is embedded in plain sight in front-end page markup for all visitors, so it functions only as a publicly readable CSRF token rather than an authentication barrier; no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
Reflected cross-site scripting in the Themify Builder WordPress plugin (versions up to and including 7.7.4) lets remote attackers inject arbitrary script that executes in a victim's browser when they follow a crafted link. The CVSS 3.1 base score of 7.1 reflects unauthenticated exploitation with a scope change, though it requires user interaction. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Stored cross-site scripting in the Themify Builder WordPress plugin affects all versions up to and including 7.8.4: authenticated users holding contributor-level access or higher can write arbitrary markup into the 'variations' repeater sub-fields (style, or the woff/woff2/ttf/svg/eot URL values) of a Custom Font (tb_cf) post, because Themify_Metabox::_save_meta() only applies wp_kses_data() when the field type is 'textbox' or 'textarea' and stores repeater values through update_post_meta() unfiltered. The injected content is later echoed without escaping by Themify_Custom_Fonts::render_columns() inside a <style> block on the Custom Fonts admin listing, so the script runs when a privileged user (typically an administrator) opens that page. The CVSS 3.1 score is 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), and no public exploit was identified at time of analysis; real-world priority is bounded by the mandatory contributor-level account, the need for the plugin to be active, and the requirement that a second, higher-privileged user visit the specific admin listing.
Stored cross-site scripting in the Themify Builder plugin for WordPress (all versions through 7.8.2) allows an authenticated attacker holding a contributor-level account or above to inject arbitrary JavaScript through the 'visible' attribute of the slider shortcode, which is then persisted and executed in the browser of any user who views the injected page. The payload survives in post content because the attribute is neither sanitized on input nor escaped on output, and it is only reachable when the 'slider' custom post type is registered - normally satisfied automatically by a Themify theme or any other plugin that registers that CPT. Exploitation is not anonymous (CVSS PR:L) and requires a victim to load the poisoned page; no public exploit code or confirmed in-the-wild activity was identified at time of analysis, and the issue rates as a moderate-priority stored-XSS rather than an emergency.
Unauthenticated styling data manipulation in the Themify Builder WordPress plugin (all versions through 7.8.0) allows any visitor to overwrite padding and margin properties on arbitrary posts, including private and draft content. The root cause is CWE-862 (missing authorization): the AJAX handler performing style writes relies solely on a WordPress nonce for access control, but that nonce is automatically broadcast to every frontend page via wp_localize_script, making it freely retrievable by any anonymous visitor. The CVSS score of 5.3 (AV:N/AC:L/PR:N/UI:N) is consistent with trivial unauthenticated network exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low exploitation complexity makes opportunistic abuse realistic.
Authorization bypass in the Themify Builder WordPress plugin (all versions through 7.7.7) permits any authenticated subscriber-level user to overwrite or delete CSS stylesheet files for arbitrary posts - including private and draft posts owned by other users - and modify plugin-scoped font options site-wide. The CSRF nonce (tf_nonce) nominally required to gate these actions is broadcast to every authenticated user visiting any public front-end builder page via wp_localize_script, making it trivially collectible and rendering it ineffective as a security control. No active exploitation is confirmed (not in CISA KEV) and no public exploit has been identified at time of analysis.
Stored Cross-Site Scripting in the Themify Builder WordPress plugin (all versions through 7.7.6) enables authenticated attackers holding contributor-level access or higher to persist arbitrary JavaScript via the Map Module's `b_width_map` field. Because the scope changes (S:C in CVSS), the injected payload executes inside every subsequent visitor's browser context - enabling session hijacking, credential theft, or administrative account takeover against any user who views an affected page. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, but the low exploitation complexity and network-accessible attack surface make it a meaningful risk on sites with open or broad contributor registration.
Stored XSS in the Themify Builder WordPress plugin (all versions through 7.7.6) allows contributor-level authenticated users to inject persistent JavaScript via the 'height_slider' Slider Module field, which executes in the browser of any visitor who loads an injected page. The scope change (S:C in CVSS) captures the cross-context impact: attacker payload runs in victims' sessions, enabling session hijacking, credential theft, or unauthorized admin actions. No active exploitation is confirmed in CISA KEV, but a patch commit (changeset 3601964) is visible in the WordPress plugin SVN repository, suggesting a fix has been committed beyond version 7.7.6.
The Themify Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including,. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.