Themify Builder

Vulnerabilities

• CVE-2026-96831

  WordPress Themify Builder plugin <= 7.8.1 - PHP Object Injection vulnerability

  High 8.8

• CVE-2024-24872

  WordPress Themify Builder Plugin <= 7.0.5 is vulnerable to Cross Site Request Forgery (CSRF)

  High 8.8

• CVE-2026-95864

  Themify Builder <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via 'css[fonts]' Parameter

  High 7.2

• CVE-2026-57369

  WordPress Themify Builder plugin <= 7.7.4 - Cross Site Scripting (XSS) vulnerability

  High 7.1

• CVE-2024-56216

  WordPress Themify Builder plugin <= 7.6.3 - Local File Inclusion vulnerability

  Medium 6.5

• CVE-2026-15097

  Themify Builder <= 7.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'height_slider' Slider Module Field

  Medium 6.4

• CVE-2026-15096

  Themify Builder <= 7.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map Module 'b_width_map' Field

  Medium 6.4

• CVE-2025-9353

  Themify Builder <= 7.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

  Medium 6.4

• CVE-2024-13319

  Themify Builder <= 7.6.5 - Reflected Cross-Site Scripting

  Medium 6.1

• CVE-2024-9385

  Themify Builder <= 7.6.2 - Reflected Cross-Site Scripting

  Medium 6.1

• CVE-2024-52423

  WordPress Themify Builder plugin <= 7.6.5 - Cross Site Scripting (XSS) vulnerability

  Medium 5.4

• CVE-2026-75027

  Themify Builder <= 7.8.0 - Missing Authorization to Unauthenticated Arbitrary Builder Data Modification via 'tb_update_old_data' AJAX Action

  Medium 5.3

• CVE-2026-15407

  Themify Builder <= 7.7.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Stylesheet Write/Delete via tb_generate_on_fly AJAX Action

  Medium 4.3

• CVE-2025-49396

  WordPress Themify Builder Plugin <= 7.6.7 - Broken Access Control Vulnerability

  Medium 4.3

• CVE-2024-7836

  Themify Builder <= 7.6.1 - Missing Authorization to Authenticated (Contributor+) Post Duplication

  Medium 4.3