Stored Cross-Site Scripting Vulnerability in Themify Builder Plugin for WordPress

CVE-2026-111726

What is CVE-2026-111726?

The Themify Builder plugin for WordPress contains a Stored Cross-Site Scripting vulnerability that arises from inadequate input sanitization and output escaping in the 'visible' Shortcode attribute. This flaw allows authenticated users with contributor-level access and above to inject malicious scripts into pages, leading to execution when users access those pages. This issue occurs primarily when the 'slider' custom post type is enabled, which happens automatically if used with a Themify theme or other plugins that register the 'slider' custom post type.

References