Executive brief
Themify Builder, a popular page-building plugin for WordPress, contains a security flaw that allows users with basic contributor permissions to inject malicious scripts into website pages. When other users, including site administrators or visitors, view these compromised pages, the hidden scripts will execute in their browsers. This could lead to unauthorized actions being performed on behalf of the victim or the theft of sensitive session information.
Technical details
A Stored Cross-Site Scripting (XSS) vulnerability exists in the Themify Builder plugin for WordPress due to improper handling of the 'b_width_map' field within the Map Module. The root cause is insufficient input sanitization and output escaping in the template-map.php and associated data management classes. An authenticated attacker with at least contributor-level privileges can inject malicious JavaScript into this field. Because the script is stored in the database and rendered without proper encoding, it executes in the context of any user who views the page. The vulnerability is present in all versions up to and including 7.7.6.
Affected products
- Themify Themify Builder up to, and including, 7.7.6
Timeline
- 2026-07-11: advisory: NVD publication date
References
- https://plugins.trac.wordpress.org/browser/themify-builder/tags/7.7.6/classes/class-builder-data-manager.php
- https://plugins.trac.wordpress.org/browser/themify-builder/tags/7.7.6/classes/class-themify-builder-active.php
- https://plugins.trac.wordpress.org/browser/themify-builder/tags/7.7.6/templates/template-map.php
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3601964%40themify-builder&new=3601964%40themify-builder
- https://www.wordfence.com/threat-intel/vulnerabilities/id/72131ba4-976b-4f89-9a69-2469f22eb5fd?source=cve