Skip to content
Noroxi

Themify Builder

themify-builder · plugin

Known security vulnerabilities for Themify Builder. Find out in seconds which version runs on your site with WP Lens.

15 known vulnerabilities

6 exploitable without logging in · latest Sep 30, 2026

Listed on wordpress.org · latest 7.8.2 · last updated Sep 24, 2026 · 5K+ installs

wordpress.org status checked on Oct 4, 2026

Vulnerabilities

  • CVE-2024-24872unauthenticated · needs a click≤ 7.0.5

    WordPress Themify Builder Plugin <= 7.0.5 is vulnerable to Cross Site Request Forgery (CSRF)

    High 8.8

  • CVE-2026-96831contributor+≤ 7.8.1

    WordPress Themify Builder plugin <= 7.8.1 - PHP Object Injection vulnerability

    High 8.8

  • CVE-2026-95864unauthenticated≤ 7.8.1

    Themify Builder <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via 'css[fonts]' Parameter

    High 7.2

  • CVE-2026-57369unauthenticated · needs a click≤ 7.7.4

    WordPress Themify Builder plugin <= 7.7.4 - Cross Site Scripting (XSS) vulnerability

    High 7.1

  • CVE-2024-56216login required≤ 7.6.3

    WordPress Themify Builder plugin <= 7.6.3 - Local File Inclusion vulnerability

    Medium 6.5

  • CVE-2026-15097contributor+≤ 7.7.6

    Themify Builder <= 7.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'height_slider' Slider Module Field

    Medium 6.4

  • CVE-2026-15096contributor+≤ 7.7.6

    Themify Builder <= 7.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map Module 'b_width_map' Field

    Medium 6.4

  • CVE-2025-9353contributor+≤ 7.6.9

    Themify Builder <= 7.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

    Medium 6.4

  • CVE-2024-13319unauthenticated · needs a click≤ 7.6.5

    Themify Builder <= 7.6.5 - Reflected Cross-Site Scripting

    Medium 6.1

  • CVE-2024-9385unauthenticated · needs a click≤ 7.6.2

    Themify Builder <= 7.6.2 - Reflected Cross-Site Scripting

    Medium 6.1

  • CVE-2024-52423login required≤ 7.6.5

    WordPress Themify Builder plugin <= 7.6.5 - Cross Site Scripting (XSS) vulnerability

    Medium 5.4

  • CVE-2026-75027unauthenticated≤ 7.8.0

    Themify Builder <= 7.8.0 - Missing Authorization to Unauthenticated Arbitrary Builder Data Modification via 'tb_update_old_data' AJAX Action

    Medium 5.3

  • CVE-2026-15407subscriber+≤ 7.7.7

    Themify Builder <= 7.7.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Stylesheet Write/Delete via tb_generate_on_fly AJAX Action

    Medium 4.3

  • CVE-2025-49396login required≤ 7.6.7

    WordPress Themify Builder Plugin <= 7.6.7 - Broken Access Control Vulnerability

    Medium 4.3

  • CVE-2024-7836contributor+≤ 7.6.1

    Themify Builder <= 7.6.1 - Missing Authorization to Authenticated (Contributor+) Post Duplication

    Medium 4.3

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory