Themify Builder vulnerabilities

2 known vulnerabilities in Themify Builder from Themifyme. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.2 High severity

  Themify Builder: Improper Neutralization of Input During Web Page Generation

  CVE-2026-95864Sep 25, 2026Themifyme

  The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'css[fonts]' Parameter in all versions up to, and including, 7.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated

• 7.1 High severity

  Themify Builder: Improper Neutralization of Input During Web Page Generation

  CVE-2026-57369Jul 13, 2026Themifyme

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Builder themify-builder allows Reflected XSS.This issue affects Themify Builder: from n/a through <= 7.7.4.