# Themify Builder <= 7.8.2 - Unauthenticated CSS Injection via tb_generate_on_fly AJAX Action

- **ID:** WPSEC-2026-1149
- **Plugin:** Themify Builder (`themify-builder`), https://wordpress.org/plugins/themify-builder/
- **Affected versions:** all versions before 7.8.3
- **Fixed in:** 7.8.3 (Update to 7.8.3 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-74
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-16)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/themify-builder
- **Fix released:** 2026-10-16
- **Published:** 2026-10-17
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1149/

## Description

The Themify Builder plugin for WordPress is vulnerable to CSS Injection via the tb_generate_on_fly AJAX action in all versions up to, and including, 7.8.2. This is due to insufficient validation of CSS selectors in the is_builder_css_selector() function. Any selector that starts with '@' or merely contains a builder class name is accepted, so braces and extra rules can be smuggled into the generated stylesheet. This makes it possible for unauthenticated attackers to inject arbitrary CSS into the Builder stylesheet of a published post whose generated stylesheet does not exist yet. The injected CSS can deface or hide page content for all visitors.

## References

- https://wpsec.com/vuln/WPSEC-2026-1149/
- https://plugins.svn.wordpress.org/themify-builder/tags/7.8.3/
- https://wordpress.org/plugins/themify-builder/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1149/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.