Stored Cross-Site Scripting Vulnerability in Themify Builder Plugin for WordPress

CVE-2026-115869

What is CVE-2026-115869?

The Themify Builder plugin for WordPress is susceptible to Stored Cross-Site Scripting through its 'variations' repeater field. This vulnerability stems from inadequate input sanitization and output escaping mechanisms, particularly in versions up to 7.8.4. When an authenticated user with contributor-level or higher access inputs data, the plugin fails to properly clean the data before saving it. Attackers can exploit this flaw to inject malicious scripts into the Custom Fonts admin listing, which may execute when viewed by other users. This poses a significant risk as it allows potential attackers to execute arbitrary scripts on affected web pages.

References