Themifyme vulnerabilities
33 CVEs and advisories name Themifyme as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-115869Themify Builder <= 7.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'variations' Repeater Field
- CVE-2026-109989Themify Popup <= 1.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via 'popup_width_unit' Parameter
- CVE-2026-111726Themify Builder <= 7.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'visible' Shortcode Attribute
- CVE-2026-96831WordPress Themify Builder plugin <= 7.8.1 - PHP Object Injection vulnerability
- CVE-2026-95864Themify Builder <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via 'css[fonts]' Parameter
- CVE-2026-78172Themify – WooCommerce Product Filter <= 1.5.5 - Reflected Cross-Site Scripting
- CVE-2026-75027Themify Builder <= 7.8.0 - Missing Authorization to Unauthenticated Arbitrary Builder Data Modification via 'tb_update_old_data' AJAX Action
- CVE-2026-15407Themify Builder <= 7.7.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Stylesheet Write/Delete via tb_generate_on_fly AJAX Action
- CVE-2026-57369WordPress Themify Builder plugin <= 7.7.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-15096Themify Builder <= 7.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map Module 'b_width_map' Field
- CVE-2026-15097Themify Builder <= 7.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'height_slider' Slider Module Field
- CVE-2026-1032Conditional Menus <= 1.2.6 - Cross-Site Request Forgery to Menu Options Update
- CVE-2026-32449WordPress Themify Event Post plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2025-67533WordPress Themify Portfolio Post plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2025-9353Themify Builder <= 7.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2025-58787WordPress Themify Popup Plugin <= 1.4.2 - Cross Site Scripting (XSS) Vulnerability
- CVE-2025-49392WordPress Themify Audio Dock Plugin <= 2.0.5 - Cross Site Scripting (XSS) Vulnerability
- CVE-2025-49395WordPress Themify Icons Plugin <= 2.0.3 - Cross Site Scripting (XSS) Vulnerability
- CVE-2025-49396WordPress Themify Builder Plugin <= 7.6.7 - Broken Access Control Vulnerability
- CVE-2025-39581WordPress Themify Shortcodes plugin <= 2.1.3 - Cross Site Scripting (XSS) Vulnerability
- CVE-2025-30832WordPress Themify Event Post Plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2025-30831WordPress Themify Event Post Plugin <= 1.3.2 - Local File Inclusion vulnerability
- CVE-2024-13319Themify Builder <= 7.6.5 - Reflected Cross-Site Scripting
- CVE-2024-56239WordPress Themify Audio Dock plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-56216WordPress Themify Builder plugin <= 7.6.3 - Local File Inclusion vulnerability
- CVE-2024-12414Themify Store Locator <= 1.1.9 - Cross-Site Request Forgery
- CVE-2024-52423WordPress Themify Builder plugin <= 7.6.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-44046WordPress Themify plugin <= 1.5.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-9385Themify Builder <= 7.6.2 - Reflected Cross-Site Scripting
- CVE-2024-7836Themify Builder <= 7.6.1 - Missing Authorization to Authenticated (Contributor+) Post Duplication