{
 "id": "WPSEC-2026-1149",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1149/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1149/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1149/index.md",
 "title": "Themify Builder <= 7.8.2 - Unauthenticated CSS Injection via tb_generate_on_fly AJAX Action",
 "description": "The Themify Builder plugin for WordPress is vulnerable to CSS Injection via the tb_generate_on_fly AJAX action in all versions up to, and including, 7.8.2. This is due to insufficient validation of CSS selectors in the is_builder_css_selector() function. Any selector that starts with '@' or merely contains a builder class name is accepted, so braces and extra rules can be smuggled into the generated stylesheet. This makes it possible for unauthenticated attackers to inject arbitrary CSS into the Builder stylesheet of a published post whose generated stylesheet does not exist yet. The injected CSS can deface or hide page content for all visitors.",
 "plugin": {
  "slug": "themify-builder",
  "name": "Themify Builder",
  "full_name": "Themify Builder",
  "wordpress_org": "https://wordpress.org/plugins/themify-builder/",
  "advisories_url": "https://wpsec.com/vuln/plugin/themify-builder/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/themify-builder"
 },
 "type": "CONTENT INJECTION",
 "cwe": [
  "CWE-74"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "7.8.3",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 7.8.3"
  ]
 },
 "introduced_in": null,
 "fixed_in": "7.8.3",
 "remediation": "Update to 7.8.3 or later.",
 "fix_released": "2026-10-16T03:13:53+00:00",
 "published": "2026-10-17T03:41:18+00:00",
 "updated": "2026-10-16T10:56:14.492713+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1149/",
  "https://plugins.svn.wordpress.org/themify-builder/tags/7.8.3/",
  "https://wordpress.org/plugins/themify-builder/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/themify-builder",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-16"
 }
}