Stored Cross-Site Scripting in Themify Builder for WordPress

CVE-2025-9353

What is CVE-2025-9353?

The Themify Builder plugin for WordPress is susceptible to a stored Cross-Site Scripting (XSS) vulnerability due to inadequate input sanitization and output escaping. This flaw allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. Such scripts will execute in the browsers of users accessing these compromised pages, which could lead to significant security breaches. Although a partial fix was introduced in version 7.6.9, the vulnerability necessitates immediate attention to ensure user protection.

References