646 matches found
WordPress Themify Builder < 7.5.8 - Open Redirect
The Themify Builder WordPress plugin before version 7.5.8 contains an open redirect vulnerability. The plugin does not validate the tbredirectfail parameter before redirecting users to its value, which could allow attackers to redirect users to malicious websites. id: CVE-2024-3032 info: name:...
CVE-2026-111726
The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'visible' Shortcode Attribute in all versions up to, and including, 7.8.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-leve...
CVE-2026-109989
The Themify Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'popupwidthunit' parameter in all versions up to, and including, 1.4.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level acce...
CVE-2026-109989 Themify Popup <= 1.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via 'popup_width_unit' Parameter
The Themify Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'popupwidthunit' parameter in all versions up to, and including, 1.4.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level acce...
CVE-2026-109989 Themify Popup <= 1.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via 'popup_width_unit' Parameter
The Themify Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'popupwidthunit' parameter in all versions up to, and including, 1.4.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level acce...
EUVD-2026-103231
The Themify Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'popupwidthunit' parameter in all versions up to, and including, 1.4.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level acce...
CVE-2026-109989
The Themify Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 1.4.7 . The root cause is insufficient input sanitization and output escaping related to the 'popup_width_unit' parameter. This flaw allows authenticated attackers with au...
CVE-2026-111726
The Themify Builder plugin for WordPress (versions up to and including 7.8.2 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping within the 'visible' Shortcode Attribute . An authenticated attacker with Contributor-level acc...
CVE-2026-111726 Themify Builder <= 7.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'visible' Shortcode Attribute
The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'visible' Shortcode Attribute in all versions up to, and including, 7.8.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-leve...
CVE-2026-111726 Themify Builder <= 7.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'visible' Shortcode Attribute
The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'visible' Shortcode Attribute in all versions up to, and including, 7.8.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-leve...
EUVD-2026-103229
The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'visible' Shortcode Attribute in all versions up to, and including, 7.8.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-leve...
CVE-2026-111726: Improper Neutralization of Input During Web Page Generation
The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'visible' Shortcode Attribute in all versions up to, and including, 7.8.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-leve...
CVE-2026-109989: Improper Neutralization of Input During Web Page Generation
The Themify Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'popupwidthunit' parameter in all versions up to, and including, 1.4.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level acce...
PT-2026-116361
Name of the Vulnerable Software and Affected Versions Themify Builder versions prior to 7.8.3 Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting XSS. This occurs via the visib...
PT-2026-116359
Name of the Vulnerable Software and Affected Versions Themify Popup versions prior to 1.4.8 Description The plugin is subject to Stored Cross-Site Scripting, a flaw where malicious scripts are permanently stored on the target server. This occurs due to insufficient input sanitization and output...
WordPress Themify Builder Cross-site Scripting Vulnerabilities
WordPress Themify Builder 7.8.2 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping for the 'visible' short-code attribute, which may lead to stored cross-site scripting. This allows authenticated attackers...
WordPress Themify Popup Cross-site Script Vulnerability
WordPress Themify Popup 1.4.7 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping for the parameter popupwidthunit. It may allow authenticated attackers with author-level or higher permissions to inject...
WordPress Themify Popup plugin <= 1.4.7 - Authenticated (Author+) Stored Cross-Site Scripting vulnerability
Authenticated Author+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Themify Popup versions = 1.4.7...
WordPress Themify Builder plugin <= 7.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Themify Builder versions = 7.8.2...