SZB-6b1d67bb43
Themify Builder WordPress plugin flagged with stored XSS flaw (EUVD-2026-114233)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- themifyme
- Product
- Themify Builder
- First seen
Summary
The EUVD entry EUVD-2026-114233, relayed via a Mastodon post, lists a CVSS v3.1 score of 6.4 for Themify Builder. The entry says the plugin is vulnerable to stored cross-site scripting via the 'variations' field of Custom Font posts in versions up to and including 7.8.4.
If you use themifyme
Update Themify Builder to a version newer than 7.8.4
Check the EUVD entry for patch status
Limit who can create or edit Custom Font content until patched
What the sources say 1
· Mastodon: “The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'variations' repeater field of Custom Font (tb_cf) posts in versions up to, and including, 7.8.4.” Source