6 matches found
CVE-2026-115869
The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'variations' repeater field of Custom Font tbcf posts in versions up to, and including, 7.8.4. This is due to insufficient input sanitization and output escaping on the variations post meta:...
CVE-2026-115869 Themify Builder <= 7.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'variations' Repeater Field
The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'variations' repeater field of Custom Font tbcf posts in versions up to, and including, 7.8.4. This is due to insufficient input sanitization and output escaping on the variations post meta:...
CVE-2026-115869 Themify Builder <= 7.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'variations' Repeater Field
The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'variations' repeater field of Custom Font tbcf posts in versions up to, and including, 7.8.4. This is due to insufficient input sanitization and output escaping on the variations post meta:...
CVE-2026-115869
The Themify Builder plugin for WordPress (versions up to and including 7.8.4 ) is vulnerable to Stored Cross-Site Scripting (XSS) via the 'variations' repeater field of Custom Font (tb_cf) posts. The root cause is insufficient input sanitization in Themify_Metabox::_save_meta(), which fails to ap...
EUVD-2026-114233
The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'variations' repeater field of Custom Font tbcf posts in versions up to, and including, 7.8.4. This is due to insufficient input sanitization and output escaping on the variations post meta:...
CVE-2026-115869: themifyme Themify Builder: The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'variations' repeater…
The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'variations' repeater field of Custom Font tbcf posts in versions up to, and including, 7.8.4. This is due to insufficient input sanitization and output escaping on the variations post meta:...