What’s Vulnerable › Products
themifyme Themify Builder vulnerabilities
16 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 12 published in the last 12 months.
Check whether your themifyme Themify Builder version is affected
Latest themifyme Themify Builder vulnerabilities
- CVE-2026-111726 — Themify Builder <= 7.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'visible' Shortcode Attribute (CVSS 6.4)
- CVE-2026-96831 — WordPress Themify Builder plugin <= 7.8.1 - PHP Object Injection vulnerability (CVSS 8.8)
- CVE-2026-95864 — Themify Builder <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via 'css[fonts]' Parameter (CVSS 7.2)
- CVE-2026-75027 — Themify Builder <= 7.8.0 - Missing Authorization to Unauthenticated Arbitrary Builder Data Modification via 'tb_update_old_data' AJAX Action (CVSS 5.3)
- CVE-2026-15407 — Themify Builder <= 7.7.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Stylesheet Write/Delete via tb_generate_on_fly AJAX Action (CVSS 4.3)
- CVE-2026-57369 — WordPress Themify Builder plugin <= 7.7.4 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- CVE-2026-15097 — Themify Builder <= 7.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'height_slider' Slider Module Field (CVSS 6.4)
- CVE-2026-15096 — Themify Builder <= 7.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map Module 'b_width_map' Field (CVSS 6.4)
- CVE-2025-9353 — Themify Builder <= 7.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- CVE-2025-49396 — WordPress Themify Builder Plugin <= 7.6.7 - Broken Access Control Vulnerability (CVSS 4.3)
- CVE-2024-56216 — WordPress Themify Builder plugin <= 7.6.3 - Local File Inclusion vulnerability (CVSS 6.5)
- CVE-2024-52423 — WordPress Themify Builder plugin <= 7.6.5 - Cross Site Scripting (XSS) vulnerability (CVSS 5.4)
- CVE-2024-9385 — Themify Builder <= 7.6.2 - Reflected Cross-Site Scripting (CVSS 6.1)
- CVE-2024-7836 — Themify Builder <= 7.6.1 - Missing Authorization to Authenticated (Contributor+) Post Duplication (CVSS 4.3)
- CVE-2024-3032 — Themify Builder < 7.5.8 - Open Redirect (CVSS 6.1)
- CVE-2024-24872 — WordPress Themify Builder Plugin <= 7.0.5 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 8.8)