181 matches found
WordPress Themify Builder < 7.5.8 - Open Redirect
The Themify Builder WordPress plugin before version 7.5.8 contains an open redirect vulnerability. The plugin does not validate the tbredirectfail parameter before redirecting users to its value, which could allow attackers to redirect users to malicious websites. id: CVE-2024-3032 info: name:...
CVE-2026-115869
The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'variations' repeater field of Custom Font tbcf posts in versions up to, and including, 7.8.4. This is due to insufficient input sanitization and output escaping on the variations post meta:...
CVE-2026-115869 Themify Builder <= 7.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'variations' Repeater Field
The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'variations' repeater field of Custom Font tbcf posts in versions up to, and including, 7.8.4. This is due to insufficient input sanitization and output escaping on the variations post meta:...
CVE-2026-115869 Themify Builder <= 7.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'variations' Repeater Field
The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'variations' repeater field of Custom Font tbcf posts in versions up to, and including, 7.8.4. This is due to insufficient input sanitization and output escaping on the variations post meta:...
EUVD-2026-114233
The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'variations' repeater field of Custom Font tbcf posts in versions up to, and including, 7.8.4. This is due to insufficient input sanitization and output escaping on the variations post meta:...
CVE-2026-115869
The Themify Builder plugin for WordPress (versions up to and including 7.8.4 ) is vulnerable to Stored Cross-Site Scripting (XSS) via the 'variations' repeater field of Custom Font (tb_cf) posts. The root cause is insufficient input sanitization in Themify_Metabox::_save_meta(), which fails to ap...
WordPress Themify Builder plugin <= 7.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Themify Builder versions = 7.8.4...
PT-2026-133702
The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'variations' repeater field of Custom Font tb cf posts in versions up to, and including, 7.8.4. This is due to insufficient input sanitization and output escaping on the variations post meta: Themify...
CVE-2026-115869: themifyme Themify Builder: The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'variations' repeater…
The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'variations' repeater field of Custom Font tbcf posts in versions up to, and including, 7.8.4. This is due to insufficient input sanitization and output escaping on the variations post meta:...
CVE-2026-111726
The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'visible' Shortcode Attribute in all versions up to, and including, 7.8.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-leve...
EUVD-2026-103229
The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'visible' Shortcode Attribute in all versions up to, and including, 7.8.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-leve...
CVE-2026-111726 Themify Builder <= 7.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'visible' Shortcode Attribute
The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'visible' Shortcode Attribute in all versions up to, and including, 7.8.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-leve...
CVE-2026-111726
The Themify Builder plugin for WordPress (versions up to and including 7.8.2 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping within the 'visible' Shortcode Attribute . An authenticated attacker with Contributor-level acc...
CVE-2026-111726 Themify Builder <= 7.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'visible' Shortcode Attribute
The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'visible' Shortcode Attribute in all versions up to, and including, 7.8.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-leve...
PT-2026-116361
Name of the Vulnerable Software and Affected Versions Themify Builder versions prior to 7.8.3 Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting XSS. This occurs via the visib...
CVE-2026-111726: Improper Neutralization of Input During Web Page Generation
The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'visible' Shortcode Attribute in all versions up to, and including, 7.8.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-leve...
WordPress Themify Builder Cross-site Scripting Vulnerabilities
WordPress Themify Builder 7.8.2 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping for the 'visible' short-code attribute, which may lead to stored cross-site scripting. This allows authenticated attackers...
WordPress Themify Builder plugin <= 7.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Themify Builder versions = 7.8.2...