Themify Builder <= 7.8.2 - Unauthenticated CSS Injection via tb_generate_on_fly AJAX Action
- ID
- WPSEC-2026-1149
- Plugin
- Themify Builder (themify-builder)
- Affected
- all versions before 7.8.3
- Remediation
- Update to 7.8.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-74
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-16
- Attack surface
- Themify Builder on WPSec AttackSurface
- Fix released
- Published
Description
The Themify Builder plugin for WordPress is vulnerable to CSS Injection via the tb_generate_on_fly AJAX action in all versions up to, and including, 7.8.2. This is due to insufficient validation of CSS selectors in the is_builder_css_selector() function. Any selector that starts with '@' or merely contains a builder class name is accepted, so braces and extra rules can be smuggled into the generated stylesheet. This makes it possible for unauthenticated attackers to inject arbitrary CSS into the Builder stylesheet of a published post whose generated stylesheet does not exist yet. The injected CSS can deface or hide page content for all visitors.
References
- https://wpsec.com/vuln/WPSEC-2026-1149/
- https://plugins.svn.wordpress.org/themify-builder/tags/7.8.3/
- https://wordpress.org/plugins/themify-builder/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS