Is CVE-2026-115869 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-115869 being exploited in the wild.

How severe is CVE-2026-115869?

Medium severity, with a CVSS score of 6.4, published 30 October 2026.

Is there a fix for CVE-2026-115869?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-115869 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-115869?

Check whether you run Themify Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-115869: Themify Builder stored cross-site scripting in Custom Font field

CVE-2026-115869 · Severity: medium · CVSS 6.4 · Published 2026-10-30

Themify Builder is a page builder plugin for WordPress that allows site administrators to design pages visually. The plugin fails to properly sanitize user input in custom font configurations, allowing authenticated contributors to inject malicious scripts that execute in the WordPress admin interface whenever another user views the Custom Fonts list. This could lead to administrator account compromise or unauthorized changes to site configuration.

Technologies: Themify Builder. Vendors: Themify.

Quick answers

Is CVE-2026-115869 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-115869 being exploited in the wild.
How severe is CVE-2026-115869?: Medium severity, with a CVSS score of 6.4, published 30 October 2026.
Which products and versions are affected?: Themify Builder up to 7.8.4.
Is there a fix for CVE-2026-115869?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-115869 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-115869?: Check whether you run Themify Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a stored cross-site scripting (XSS) flaw in the 'variations' repeater field of Custom Font (tb_cf) posts. The Themify_Metabox::_save_meta() function applies insufficient sanitization (only filtering 'textbox' and 'textarea' fields) while repeater field sub-fields containing attacker-controlled CSS styles and font URLs are written to post metadata unescaped. These values are later echoed without escaping by Themify_Custom_Fonts::render_columns() in the Custom Fonts admin listing, allowing authenticated contributors to execute arbitrary JavaScript.

Affected products

Themify Builder up to 7.8.4

Timeline

2026-10-30: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.