Themifyme
Monthly
Authenticated Contributor-level users can exploit a PHP Object Injection vulnerability in Themify Builder versions up to and including 7.8.1. The flaw, caused by unsafe deserialization (CWE-502), allows an attacker with a Contributor account to inject a serialized PHP object, potentially leading to remote code execution or full site compromise if a usable PHP gadget chain exists in the WordPress installation. The vendor-assigned CVSS score is 8.8 (High), and no public exploit code has been identified at the time of analysis.
Stored cross-site scripting in the Themify Builder plugin for WordPress, affecting all versions up to and including 7.8.1, allows unauthenticated attackers to inject arbitrary JavaScript through the css[fonts] parameter; the payload is persisted in site styling and executes in the browser of any visitor who later views the affected page. The assessed CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, score 7.2) confirms this is a network-reachable, unauthenticated attack requiring no victim interaction to plant the payload, with scope change because the injected content escapes the plugin's own security boundary into site pages. The intended nonce protection is ineffective: the nonce is embedded in plain sight in front-end page markup for all visitors, so it functions only as a publicly readable CSRF token rather than an authentication barrier; no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
Reflected cross-site scripting in the Themify Builder WordPress plugin (versions up to and including 7.7.4) lets remote attackers inject arbitrary script that executes in a victim's browser when they follow a crafted link. The CVSS 3.1 base score of 7.1 reflects unauthenticated exploitation with a scope change, though it requires user interaction. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Stored cross-site scripting in the Themify Builder WordPress plugin affects all versions up to and including 7.8.4: authenticated users holding contributor-level access or higher can write arbitrary markup into the 'variations' repeater sub-fields (style, or the woff/woff2/ttf/svg/eot URL values) of a Custom Font (tb_cf) post, because Themify_Metabox::_save_meta() only applies wp_kses_data() when the field type is 'textbox' or 'textarea' and stores repeater values through update_post_meta() unfiltered. The injected content is later echoed without escaping by Themify_Custom_Fonts::render_columns() inside a <style> block on the Custom Fonts admin listing, so the script runs when a privileged user (typically an administrator) opens that page. The CVSS 3.1 score is 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), and no public exploit was identified at time of analysis; real-world priority is bounded by the mandatory contributor-level account, the need for the plugin to be active, and the requirement that a second, higher-privileged user visit the specific admin listing.
Stored cross-site scripting in the Themify Popup plugin for WordPress (all versions up to and including 1.4.7) allows an authenticated user holding author-level privileges or higher to persist arbitrary script into the site's popup configuration via the 'popup_width_unit' parameter, which is then executed in the browser of any visitor or administrator who loads the injected page. Because the payload is stored rather than reflected, a single low-privilege write can compromise every subsequent page view, and the CVSS:3.1 scope-change rating (S:C) reflects that the injected script runs in the broader site context rather than an isolated component. Exploitation is gated by the author-level account prerequisite and requires no interaction from the victim (UI:N); there is no public exploit code or CISA KEV entry identified at time of analysis, and EPSS data was not supplied, so the practical risk is concentrated on multi-author sites that grant author or higher roles to untrusted or self-registered users.
Stored cross-site scripting in the Themify Builder plugin for WordPress (all versions through 7.8.2) allows an authenticated attacker holding a contributor-level account or above to inject arbitrary JavaScript through the 'visible' attribute of the slider shortcode, which is then persisted and executed in the browser of any user who views the injected page. The payload survives in post content because the attribute is neither sanitized on input nor escaped on output, and it is only reachable when the 'slider' custom post type is registered - normally satisfied automatically by a Themify theme or any other plugin that registers that CPT. Exploitation is not anonymous (CVSS PR:L) and requires a victim to load the poisoned page; no public exploit code or confirmed in-the-wild activity was identified at time of analysis, and the issue rates as a moderate-priority stored-XSS rather than an emergency.
Reflected Cross-Site Scripting in the Themify WooCommerce Product Filter WordPress plugin (versions ≤1.5.5) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in victims' browsers by tricking them into clicking a crafted URL containing a malicious query parameter name. The vulnerability stems from insufficient sanitization and escaping in class-wpf-utils.php and class-wpf-public.php, as confirmed by Wordfence source references. An upstream fix has been committed to the WordPress plugin SVN trunk, though an exact released patched version is not confirmed from available data. No public exploit code or CISA KEV listing has been identified.
Unauthenticated styling data manipulation in the Themify Builder WordPress plugin (all versions through 7.8.0) allows any visitor to overwrite padding and margin properties on arbitrary posts, including private and draft content. The root cause is CWE-862 (missing authorization): the AJAX handler performing style writes relies solely on a WordPress nonce for access control, but that nonce is automatically broadcast to every frontend page via wp_localize_script, making it freely retrievable by any anonymous visitor. The CVSS score of 5.3 (AV:N/AC:L/PR:N/UI:N) is consistent with trivial unauthenticated network exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low exploitation complexity makes opportunistic abuse realistic.
Authorization bypass in the Themify Builder WordPress plugin (all versions through 7.7.7) permits any authenticated subscriber-level user to overwrite or delete CSS stylesheet files for arbitrary posts - including private and draft posts owned by other users - and modify plugin-scoped font options site-wide. The CSRF nonce (tf_nonce) nominally required to gate these actions is broadcast to every authenticated user visiting any public front-end builder page via wp_localize_script, making it trivially collectible and rendering it ineffective as a security control. No active exploitation is confirmed (not in CISA KEV) and no public exploit has been identified at time of analysis.
Stored Cross-Site Scripting in the Themify Builder WordPress plugin (all versions through 7.7.6) enables authenticated attackers holding contributor-level access or higher to persist arbitrary JavaScript via the Map Module's `b_width_map` field. Because the scope changes (S:C in CVSS), the injected payload executes inside every subsequent visitor's browser context - enabling session hijacking, credential theft, or administrative account takeover against any user who views an affected page. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, but the low exploitation complexity and network-accessible attack surface make it a meaningful risk on sites with open or broad contributor registration.
Stored XSS in the Themify Builder WordPress plugin (all versions through 7.7.6) allows contributor-level authenticated users to inject persistent JavaScript via the 'height_slider' Slider Module field, which executes in the browser of any visitor who loads an injected page. The scope change (S:C in CVSS) captures the cross-context impact: attacker payload runs in victims' sessions, enabling session hijacking, credential theft, or unauthorized admin actions. No active exploitation is confirmed in CISA KEV, but a patch commit (changeset 3601964) is visible in the WordPress plugin SVN repository, suggesting a fix has been committed beyond version 7.7.6.
Unauthenticated attackers can modify conditional menu assignments in the Conditional Menus WordPress plugin (versions up to 1.2.6) through cross-site request forgery attacks by exploiting missing nonce validation in the save_options function. An attacker can trick site administrators into clicking a malicious link to alter menu configurations without their knowledge. No patch is currently available for this vulnerability.
A Stored Cross-Site Scripting (XSS) vulnerability exists in the Themify Event Post WordPress plugin (versions up to 1.3.4) that allows authenticated users with low privileges to inject malicious scripts into web pages, which are then executed in the browsers of other site visitors. An attacker with login credentials can craft malicious input that persists in the database and affects all users viewing affected pages, potentially leading to session hijacking, credential theft, or website defacement. The vulnerability requires user interaction (UI:R) and authenticated access (PR:L), limiting but not eliminating real-world risk.
Authenticated Contributor-level users can exploit a PHP Object Injection vulnerability in Themify Builder versions up to and including 7.8.1. The flaw, caused by unsafe deserialization (CWE-502), allows an attacker with a Contributor account to inject a serialized PHP object, potentially leading to remote code execution or full site compromise if a usable PHP gadget chain exists in the WordPress installation. The vendor-assigned CVSS score is 8.8 (High), and no public exploit code has been identified at the time of analysis.
Stored cross-site scripting in the Themify Builder plugin for WordPress, affecting all versions up to and including 7.8.1, allows unauthenticated attackers to inject arbitrary JavaScript through the css[fonts] parameter; the payload is persisted in site styling and executes in the browser of any visitor who later views the affected page. The assessed CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, score 7.2) confirms this is a network-reachable, unauthenticated attack requiring no victim interaction to plant the payload, with scope change because the injected content escapes the plugin's own security boundary into site pages. The intended nonce protection is ineffective: the nonce is embedded in plain sight in front-end page markup for all visitors, so it functions only as a publicly readable CSRF token rather than an authentication barrier; no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
Reflected cross-site scripting in the Themify Builder WordPress plugin (versions up to and including 7.7.4) lets remote attackers inject arbitrary script that executes in a victim's browser when they follow a crafted link. The CVSS 3.1 base score of 7.1 reflects unauthenticated exploitation with a scope change, though it requires user interaction. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Stored cross-site scripting in the Themify Builder WordPress plugin affects all versions up to and including 7.8.4: authenticated users holding contributor-level access or higher can write arbitrary markup into the 'variations' repeater sub-fields (style, or the woff/woff2/ttf/svg/eot URL values) of a Custom Font (tb_cf) post, because Themify_Metabox::_save_meta() only applies wp_kses_data() when the field type is 'textbox' or 'textarea' and stores repeater values through update_post_meta() unfiltered. The injected content is later echoed without escaping by Themify_Custom_Fonts::render_columns() inside a <style> block on the Custom Fonts admin listing, so the script runs when a privileged user (typically an administrator) opens that page. The CVSS 3.1 score is 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), and no public exploit was identified at time of analysis; real-world priority is bounded by the mandatory contributor-level account, the need for the plugin to be active, and the requirement that a second, higher-privileged user visit the specific admin listing.
Stored cross-site scripting in the Themify Popup plugin for WordPress (all versions up to and including 1.4.7) allows an authenticated user holding author-level privileges or higher to persist arbitrary script into the site's popup configuration via the 'popup_width_unit' parameter, which is then executed in the browser of any visitor or administrator who loads the injected page. Because the payload is stored rather than reflected, a single low-privilege write can compromise every subsequent page view, and the CVSS:3.1 scope-change rating (S:C) reflects that the injected script runs in the broader site context rather than an isolated component. Exploitation is gated by the author-level account prerequisite and requires no interaction from the victim (UI:N); there is no public exploit code or CISA KEV entry identified at time of analysis, and EPSS data was not supplied, so the practical risk is concentrated on multi-author sites that grant author or higher roles to untrusted or self-registered users.
Stored cross-site scripting in the Themify Builder plugin for WordPress (all versions through 7.8.2) allows an authenticated attacker holding a contributor-level account or above to inject arbitrary JavaScript through the 'visible' attribute of the slider shortcode, which is then persisted and executed in the browser of any user who views the injected page. The payload survives in post content because the attribute is neither sanitized on input nor escaped on output, and it is only reachable when the 'slider' custom post type is registered - normally satisfied automatically by a Themify theme or any other plugin that registers that CPT. Exploitation is not anonymous (CVSS PR:L) and requires a victim to load the poisoned page; no public exploit code or confirmed in-the-wild activity was identified at time of analysis, and the issue rates as a moderate-priority stored-XSS rather than an emergency.
Reflected Cross-Site Scripting in the Themify WooCommerce Product Filter WordPress plugin (versions ≤1.5.5) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in victims' browsers by tricking them into clicking a crafted URL containing a malicious query parameter name. The vulnerability stems from insufficient sanitization and escaping in class-wpf-utils.php and class-wpf-public.php, as confirmed by Wordfence source references. An upstream fix has been committed to the WordPress plugin SVN trunk, though an exact released patched version is not confirmed from available data. No public exploit code or CISA KEV listing has been identified.
Unauthenticated styling data manipulation in the Themify Builder WordPress plugin (all versions through 7.8.0) allows any visitor to overwrite padding and margin properties on arbitrary posts, including private and draft content. The root cause is CWE-862 (missing authorization): the AJAX handler performing style writes relies solely on a WordPress nonce for access control, but that nonce is automatically broadcast to every frontend page via wp_localize_script, making it freely retrievable by any anonymous visitor. The CVSS score of 5.3 (AV:N/AC:L/PR:N/UI:N) is consistent with trivial unauthenticated network exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low exploitation complexity makes opportunistic abuse realistic.
Authorization bypass in the Themify Builder WordPress plugin (all versions through 7.7.7) permits any authenticated subscriber-level user to overwrite or delete CSS stylesheet files for arbitrary posts - including private and draft posts owned by other users - and modify plugin-scoped font options site-wide. The CSRF nonce (tf_nonce) nominally required to gate these actions is broadcast to every authenticated user visiting any public front-end builder page via wp_localize_script, making it trivially collectible and rendering it ineffective as a security control. No active exploitation is confirmed (not in CISA KEV) and no public exploit has been identified at time of analysis.
Stored Cross-Site Scripting in the Themify Builder WordPress plugin (all versions through 7.7.6) enables authenticated attackers holding contributor-level access or higher to persist arbitrary JavaScript via the Map Module's `b_width_map` field. Because the scope changes (S:C in CVSS), the injected payload executes inside every subsequent visitor's browser context - enabling session hijacking, credential theft, or administrative account takeover against any user who views an affected page. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, but the low exploitation complexity and network-accessible attack surface make it a meaningful risk on sites with open or broad contributor registration.
Stored XSS in the Themify Builder WordPress plugin (all versions through 7.7.6) allows contributor-level authenticated users to inject persistent JavaScript via the 'height_slider' Slider Module field, which executes in the browser of any visitor who loads an injected page. The scope change (S:C in CVSS) captures the cross-context impact: attacker payload runs in victims' sessions, enabling session hijacking, credential theft, or unauthorized admin actions. No active exploitation is confirmed in CISA KEV, but a patch commit (changeset 3601964) is visible in the WordPress plugin SVN repository, suggesting a fix has been committed beyond version 7.7.6.
Unauthenticated attackers can modify conditional menu assignments in the Conditional Menus WordPress plugin (versions up to 1.2.6) through cross-site request forgery attacks by exploiting missing nonce validation in the save_options function. An attacker can trick site administrators into clicking a malicious link to alter menu configurations without their knowledge. No patch is currently available for this vulnerability.
A Stored Cross-Site Scripting (XSS) vulnerability exists in the Themify Event Post WordPress plugin (versions up to 1.3.4) that allows authenticated users with low privileges to inject malicious scripts into web pages, which are then executed in the browsers of other site visitors. An attacker with login credentials can craft malicious input that persists in the database and affects all users viewing affected pages, potentially leading to session hijacking, credential theft, or website defacement. The vulnerability requires user interaction (UI:R) and authenticated access (PR:L), limiting but not eliminating real-world risk.