# cve.now: Themifyme

The newest entries naming Themifyme as an affected vendor (up to 200), of 33 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-115869](https://cve.now/CVE-2026-115869.md): Themify Builder \<= 7.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'variations' Repeater Field (CVSS 6.4)
- [CVE-2026-109989](https://cve.now/CVE-2026-109989.md): Themify Popup \<= 1.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via 'popup\_width\_unit' Parameter (CVSS 6.4)
- [CVE-2026-111726](https://cve.now/CVE-2026-111726.md): Themify Builder \<= 7.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'visible' Shortcode Attribute (CVSS 6.4)
- [CVE-2026-96831](https://cve.now/CVE-2026-96831.md): WordPress Themify Builder plugin \<= 7.8.1 - PHP Object Injection vulnerability (CVSS 8.8)
- [CVE-2026-95864](https://cve.now/CVE-2026-95864.md): Themify Builder \<= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via 'css\[fonts\]' Parameter (CVSS 7.2)
- [CVE-2026-78172](https://cve.now/CVE-2026-78172.md): Themify – WooCommerce Product Filter \<= 1.5.5 - Reflected Cross-Site Scripting (CVSS 6.1)
- [CVE-2026-75027](https://cve.now/CVE-2026-75027.md): Themify Builder \<= 7.8.0 - Missing Authorization to Unauthenticated Arbitrary Builder Data Modification via 'tb\_update\_old\_data' AJAX Action (CVSS 5.3)
- [CVE-2026-15407](https://cve.now/CVE-2026-15407.md): Themify Builder \<= 7.7.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Stylesheet Write/Delete via tb\_generate\_on\_fly AJAX Action (CVSS 4.3)
- [CVE-2026-57369](https://cve.now/CVE-2026-57369.md): WordPress Themify Builder plugin \<= 7.7.4 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-15096](https://cve.now/CVE-2026-15096.md): Themify Builder \<= 7.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map Module 'b\_width\_map' Field (CVSS 6.4)
- [CVE-2026-15097](https://cve.now/CVE-2026-15097.md): Themify Builder \<= 7.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'height\_slider' Slider Module Field (CVSS 6.4)
- [CVE-2026-1032](https://cve.now/CVE-2026-1032.md): Conditional Menus \<= 1.2.6 - Cross-Site Request Forgery to Menu Options Update (CVSS 4.3)
- [CVE-2026-32449](https://cve.now/CVE-2026-32449.md): WordPress Themify Event Post plugin \<= 1.3.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-67533](https://cve.now/CVE-2025-67533.md): WordPress Themify Portfolio Post plugin \<= 1.3.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-9353](https://cve.now/CVE-2025-9353.md): Themify Builder \<= 7.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2025-58787](https://cve.now/CVE-2025-58787.md): WordPress Themify Popup Plugin \<= 1.4.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- [CVE-2025-49392](https://cve.now/CVE-2025-49392.md): WordPress Themify Audio Dock Plugin \<= 2.0.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9)
- [CVE-2025-49395](https://cve.now/CVE-2025-49395.md): WordPress Themify Icons Plugin \<= 2.0.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- [CVE-2025-49396](https://cve.now/CVE-2025-49396.md): WordPress Themify Builder Plugin \<= 7.6.7 - Broken Access Control Vulnerability (CVSS 4.3)
- [CVE-2025-39581](https://cve.now/CVE-2025-39581.md): WordPress Themify Shortcodes plugin \<= 2.1.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- [CVE-2025-30832](https://cve.now/CVE-2025-30832.md): WordPress Themify Event Post Plugin \<= 1.3.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-30831](https://cve.now/CVE-2025-30831.md): WordPress Themify Event Post Plugin \<= 1.3.2 - Local File Inclusion vulnerability (CVSS 7.5)
- [CVE-2024-13319](https://cve.now/CVE-2024-13319.md): Themify Builder \<= 7.6.5 - Reflected Cross-Site Scripting (CVSS 6.1)
- [CVE-2024-56239](https://cve.now/CVE-2024-56239.md): WordPress Themify Audio Dock plugin \<= 2.0.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-56216](https://cve.now/CVE-2024-56216.md): WordPress Themify Builder plugin \<= 7.6.3 - Local File Inclusion vulnerability (CVSS 6.5)
- [CVE-2024-12414](https://cve.now/CVE-2024-12414.md): Themify Store Locator \<= 1.1.9 - Cross-Site Request Forgery (CVSS 4.3)
- [CVE-2024-52423](https://cve.now/CVE-2024-52423.md): WordPress Themify Builder plugin \<= 7.6.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-44046](https://cve.now/CVE-2024-44046.md): WordPress Themify plugin \<= 1.5.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2024-9385](https://cve.now/CVE-2024-9385.md): Themify Builder \<= 7.6.2 - Reflected Cross-Site Scripting (CVSS 6.1)
- [CVE-2024-7836](https://cve.now/CVE-2024-7836.md): Themify Builder \<= 7.6.1 - Missing Authorization to Authenticated (Contributor+) Post Duplication (CVSS 4.3)
- [CVE-2024-6027](https://cve.now/CVE-2024-6027.md): Themify - WooCommerce Product Filter \<= 1.4.9 - Unauthenticated SQL Injection via conditions Parameter (CVSS 9.8)
- [CVE-2024-4567](https://cve.now/CVE-2024-4567.md): Themify Shortcodes \<= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via themify\_button Shortcode (CVSS 6.4)
- [CVE-2024-2732](https://cve.now/CVE-2024-2732.md): Themify Shortcodes \<= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 5.4)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/themifyme
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.