CVE-2026-111726

The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'visible' Shortcode Attribute in all versions up to, and including, 7.8.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-leve...

CVE-2026-111726 Themify Builder <= 7.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'visible' Shortcode Attribute

The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'visible' Shortcode Attribute in all versions up to, and including, 7.8.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-leve...

CVE-2026-111726 Themify Builder <= 7.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'visible' Shortcode Attribute

The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'visible' Shortcode Attribute in all versions up to, and including, 7.8.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-leve...

CVE-2026-111726

The Themify Builder plugin for WordPress (versions up to and including 7.8.2 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping within the 'visible' Shortcode Attribute . An authenticated attacker with Contributor-level acc...

EUVD-2026-103229

The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'visible' Shortcode Attribute in all versions up to, and including, 7.8.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-leve...

WordPress Themify Builder < 7.5.8 - Open Redirect

The Themify Builder WordPress plugin before version 7.5.8 contains an open redirect vulnerability. The plugin does not validate the tbredirectfail parameter before redirecting users to its value, which could allow attackers to redirect users to malicious websites. id: CVE-2024-3032 info: name:...

WordPress Themify Builder plugin <= 7.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Themify Builder versions = 7.8.2...

CVE-2026-96831

Contributor PHP Object Injection in Themify Builder = 7.8.1 versions...

EUVD-2026-89883

Contributor PHP Object Injection in Themify Builder = 7.8.1 versions...

CVE-2026-96831 WordPress Themify Builder plugin <= 7.8.1 - PHP Object Injection vulnerability

Contributor PHP Object Injection in Themify Builder = 7.8.1 versions...

CVE-2026-96831 WordPress Themify Builder plugin <= 7.8.1 - PHP Object Injection vulnerability

Contributor PHP Object Injection in Themify Builder = 7.8.1 versions...

CVE-2026-96831

The Themify Builder plugin for WordPress, version 7.8.1 and below , is vulnerable to a PHP Object Injection flaw. The vulnerability allows an attacker to potentially compromise the system's integrity, confidentiality, and availability. While the provided documents confirm the existence of the vul...

PT-2026-103215

Contributor PHP Object Injection in Themify Builder = 7.8.1 versions...

CVE-2026-96831: Deserialization of Untrusted Data

Contributor PHP Object Injection in Themify Builder = 7.8.1 versions...

WordPress Themify Builder plugin <= 7.8.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Themify Builder versions = 7.8.1...

WordPress Themify Builder plugin <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by thevietronin in WordPress Plugin Themify Builder versions = 7.8.1...

CVE-2026-95864

The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cssfonts' Parameter in all versions up to, and including, 7.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scrip...

CVE-2026-95864

The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 7.8.1 . The flaw stems from insufficient input sanitization and output escaping involving the 'css[fonts]' parameter . Unauthenticated attackers can inject arbitrary web...

EUVD-2026-86580

The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cssfonts' Parameter in all versions up to, and including, 7.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scrip...

CVE-2026-95864 Themify Builder <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via 'css[fonts]' Parameter

The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cssfonts' Parameter in all versions up to, and including, 7.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scrip...