CVE-2026-15096

🗓️ 11 Jul 2026 03:44:23Reported by WordfenceType

CVE-2026-15096 allows contributors to store script injection in Themify Builder up to 7.7.6 via Map Module b_width_map.

Reporter	Title	Published	Views	Family All 5
Circl	CVE-2026-15096	11 Jul 202605:27	–	circl
Cvelist	CVE-2026-15096 Themify Builder <= 7.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map Module 'b_width_map' Field	11 Jul 202603:44	–	cvelist
EUVD	EUVD-2026-43139	11 Jul 202603:44	–	euvd
NVD	CVE-2026-15096	11 Jul 202605:16	–	nvd
Positive Technologies	PT-2026-57391	11 Jul 202600:00	–	ptsecurity

Vulners

Node

themifyme themify_builderRange≤7.7.6wordpress

[
  {
    "vendor": "themifyme",
    "product": "Themify Builder",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "7.7.6",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/changeset
plugins	www.plugins.trac.wordpress.org/browser/themify-builder/tags/7.7.6/classes/class-builder-data-manager.php
plugins	www.plugins.trac.wordpress.org/browser/themify-builder/tags/7.7.6/templates/template-map.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/72131ba4-976b-4f89-9a69-2469f22eb5fd
plugins	www.plugins.trac.wordpress.org/browser/themify-builder/tags/7.7.6/classes/class-themify-builder-active.php

11 Jul 2026 05:16Current

6.2Medium risk

Vulners AI Score6.2

CVSS 3.16.4

CWE-79