Live › vulnerability › CVE-2026-111726
Go to dashboardThe Themify Builder plugin for WordPress does not sanitize the 'visible' shortcode attribute, so text stored in pages runs as script in visitors' browsers. An attacker with contributor-level access can plant the script, and it executes whenever a user opens the injected page.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running Themify Builder up to and including 7.8.2 where the 'slider' custom post type is active, which happens with any Themify theme. Exposure needs an account with contributor role or higher, so sites with only trusted editors face less risk. Sites without the plugin or on a fixed version can skip it.
No product ranges from the sources yet.
wp plugin get themify-builder --field=version7.8.2, as listed in the vendor's changelog or the WordPress plugin repositoryEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'visible' Shortcode Attribute in all versions up to, and including, 7.8.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the 'slider' custom post type is active, which is satisfied automatically when the plugin is paired with a Themify theme or any other plugin that registers the 'slider' CPT.
This page as .md · .json · in your agent: get_signal("CVE-2026-111726")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.