Vulnerabilities / Themify Builder
Themify Builder vulnerabilities
Advisories WPSec published for Themify Builder. Other sources may list more. Its attack surface: Themify Builder on WPSec AttackSurface.
| Published | ID | Vulnerability | Severity | Fixed in |
|---|---|---|---|---|
| 2026-10-17 | WPSEC-2026-1149 | Themify Builder <= 7.8.2 - Unauthenticated CSS Injection via tb_generate_on_fly AJAX Action | Low 3.7 | 7.8.3 |
| 2026-10-17 | WPSEC-2026-1148 | Themify Builder <= 7.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider 'visible' Attribute | Medium 6.4 | 7.8.3 |
| 2026-10-17 | WPSEC-2026-1147 | Themify Builder <= 7.8.2 - Unauthenticated Arbitrary Mailing List Subscription via Optin Module | Medium 5.3 | 7.8.3 |
| 2026-10-17 | WPSEC-2026-1146 | Themify Builder <= 7.8.2 - Unauthenticated Sensitive Information Exposure via Search & Filter Meta Parameters | Medium 5.3 | 7.8.3 |
License: CC BY 4.0