Plugin icon

Themify Builder

themify-builder

Vulnerabilities:

18

Last Updated:

October 16, 2026

Active Installs:

6000

Published
Title
Fixed in
CVSS
Published
2026-10-16
Title
Themify Builder < 7.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'visible' Shortcode Attribute
Fixed in
Fixed in 7.8.3
CVSS
5.5 (medium)
Published
2026-09-28
Title
Themify Builder < 7.8.2 - Authenticated (Contributor+) PHP Object Injection
Fixed in
Fixed in 7.8.2
CVSS
6.6 (medium)
Published
2026-09-24
Title
Themify Builder < 7.8.2 - Unauthenticated Stored Cross-Site Scripting via 'css[fonts]' Parameter
Fixed in
Fixed in 7.8.2
CVSS
7.2 (high)
Published
2026-08-21
Title
Themify Builder < 7.8.1 - Missing Authorization to Unauthenticated Arbitrary Builder Data Modification via 'tb_update_old_data' AJAX Action
Fixed in
Fixed in 7.8.1
CVSS
5.3 (medium)
Published
2026-07-15
Title
Themify Builder < 7.7.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Stylesheet Write/Delete via tb_generate_on_fly AJAX Action
Fixed in
Fixed in 7.7.8
CVSS
4.3 (medium)
Published
2026-07-10
Title
Themify Builder < 7.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map Module 'b_width_map' Field
Fixed in
Fixed in 7.7.7
CVSS
5.5 (medium)
Published
2026-07-10
Title
Themify Builder < 7.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'height_slider' Slider Module Field
Fixed in
Fixed in 7.7.7
CVSS
5.5 (medium)
Published
2026-07-07
Title
Themify Builder < 7.7.5 - Unauthenticated Stored Cross-Site Scripting
Fixed in
Fixed in 7.7.5
CVSS
7.2 (high)
Published
2025-09-23
Title
Themify Builder < 7.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 7.7.0
CVSS
6.4 (medium)
Published
2025-08-20
Title
Themify Builder < 7.6.8 - Missing Authorization
Fixed in
Fixed in 7.6.8
CVSS
4.3 (medium)
Published
2025-01-21
Title
Themify Builder < 7.6.6 - Reflected Cross-Site Scripting
Fixed in
Fixed in 7.6.6
CVSS
6.1 (medium)
Published
2024-12-19
Title
Themify Builder < 7.6.5 - Authenticated (Contributor+) Local File Inclusion
Fixed in
Fixed in 7.6.5
CVSS
8.8 (high)
Published
2024-11-13
Title
Themify Builder < 7.6.6 - Contributor+ Stored XSS
Fixed in
Fixed in 7.6.6
CVSS
5.9 (medium)
Published
2024-10-04
Title
Themify Builder < 7.6.3 - Reflected Cross-Site Scripting
Fixed in
Fixed in 7.6.3
CVSS
6.1 (medium)
Published
2024-08-21
Title
Themify Builder < 7.6.2 - Missing Authorization to Authenticated (Contributor+) Post Duplication
Fixed in
Fixed in 7.6.2
CVSS
4.3 (medium)
Published
2024-05-23
Title
Themify Builder < 7.5.8 - Open Redirect
Fixed in
Fixed in 7.5.8
CVSS
4.3 (medium)
Published
2024-02-05
Title
Themify Builder < 7.0.6 - Cross-Site Request Forgery
Fixed in
Fixed in 7.0.6
CVSS
4.3 (medium)
Published
2021-10-04
Title
Themify Builder < 5.3.2 - Reflected Cross-Site Scripting
Fixed in
Fixed in 5.3.2
CVSS
8.8 (high)