Themify Builder
Approved changes feed: RSS · Atom
cpe:2.3:a:themifyme:themify_builder:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Themifyme (f7e895d5-5092-5eb3-86f0-2330c85eaa63) |
|---|---|
| Product | Themify Builder (8d899811-2b8d-5d31-ae80-9e30cc31faf4) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-57369 |
vulnerable | 2026-07-29 01:00:29.679656 |
WordPress Themify Builder plugin <= 7.7.4 - Cross Site Scripting (XSS) vulnerability
HIGH (7.1)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Builder themify-builder allows Reflected XSS.This issue affects Themify Builder: from n/a through <= 7.7.4.
Published: 2026-07-13T08:41:23.644Z
Updated: 2026-07-13T13:58:15.685Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-15407 |
vulnerable | 2026-07-29 00:26:18.083375 |
Themify Builder <= 7.7.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Stylesheet Write/Delete via tb_generate_on_fly AJAX Action
MEDIUM (4.3)
The Themify Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.7.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite or delete the generated CSS stylesheet file of arbitrary posts, including private and draft posts owned by other users, and modify plugin-scoped font options. The required CSRF nonce (tf_nonce) is emitted on public front-end builder pages via wp_localize_script, making it trivially obtainable by any authenticated user visiting such a page.
Published: 2026-07-16T07:51:04.964Z
Updated: 2026-07-18T02:44:35.429Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-15097 |
vulnerable | 2026-07-29 00:26:17.804970 |
Themify Builder <= 7.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'height_slider' Slider Module Field
MEDIUM (6.4)
The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'height_slider' Slider Module Field in all versions up to, and including, 7.7.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Published: 2026-07-11T03:44:20.706Z
Updated: 2026-07-15T13:47:50.221Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-15096 |
vulnerable | 2026-07-29 00:26:17.804782 |
Themify Builder <= 7.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map Module 'b_width_map' Field
MEDIUM (6.4)
The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Map Module 'b_width_map' Field in all versions up to, and including, 7.7.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Published: 2026-07-11T03:44:23.435Z
Updated: 2026-07-13T16:13:09.307Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-9353 |
vulnerable | 2026-06-08 07:45:22.329731 |
Themify Builder <= 7.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
MEDIUM (6.4)
The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in all versions up to, and including, 7.6.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 7.6.9.
Published: 2025-09-24T12:27:28.647Z
Updated: 2026-04-08T16:52:22.072Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-49396 |
vulnerable | 2026-06-08 07:29:13.023373 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-9385 |
vulnerable | 2026-06-08 07:00:27.230237 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-7836 |
vulnerable | 2026-06-08 06:58:23.645777 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-56216 |
vulnerable | 2026-06-08 06:54:17.552426 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-52423 |
vulnerable | 2026-06-08 06:52:15.135585 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-13319 |
vulnerable | 2026-06-08 06:25:37.269016 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.