{"id":"CVE-2026-111726","kind":"vulnerability","aliases":["CVE-2026-111726"],"related":[],"title":"Themify Builder WordPress plugin: stored XSS via shortcode attribute","description":"The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'visible' Shortcode Attribute in all versions up to, and including, 7.8.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the 'slider' custom post type is active, which is satisfied automatically when the plugin is paired with a Themify theme or any other plugin that registers the 'slider' CPT.","summary":"The Themify Builder plugin for WordPress does not sanitize the 'visible' shortcode attribute, so text stored in pages runs as script in visitors' browsers. An attacker with contributor-level access can plant the script, and it executes whenever a user opens the injected page.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","themify-builder","wordpress"],"not_affected_if":["no-contributor-accounts","patched-version","plugin-not-installed"],"how_to_check":"- Check the installed Themify Builder version in the WordPress plugins list or `wp plugin get themify-builder --field=version`\n- Check whether the 'slider' custom post type is registered, which happens automatically with a Themify theme or another plugin that registers it\n- Look for [slider] or similar shortcodes with a 'visible' attribute in post content","fix":"- Update Themify Builder to a version later than `7.8.2`, as listed in the vendor's changelog or the WordPress plugin repository\n- Until updated, restrict contributor-level accounts to trusted users","status":"open","published_at":"2026-10-17T04:16:52+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T03:59:37+00:00","updated_at":"2026-10-25T03:59:37+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T03:59:37Z","model":"claude-haiku-5-5","output":{"fix":"- Update Themify Builder to a version later than `7.8.2`, as listed in the vendor's changelog or the WordPress plugin repository\n- Until updated, restrict contributor-level accounts to trusted users","reach":"internet","title":"Themify Builder WordPress plugin: stored XSS via shortcode attribute","impact":"medium","summary":"The Themify Builder plugin for WordPress does not sanitize the 'visible' shortcode attribute, so text stored in pages runs as script in visitors' browsers. An attacker with contributor-level access can plant the script, and it executes whenever a user opens the injected page.","category":"package","nicknames":[],"who_cares":["wordpress","themify-builder","self-hosted"],"confidence":0.8,"needs_auth":"yes","worst_case":"Injected script runs in visitors' browsers, potentially hijacking sessions or admin actions","analyst_note":"","how_to_check":"- Check the installed Themify Builder version in the WordPress plugins list or `wp plugin get themify-builder --field=version`\n- Check whether the 'slider' custom post type is registered, which happens automatically with a Themify theme or another plugin that registers it\n- Look for [slider] or similar shortcodes with a 'visible' attribute in post content","needs_analyst":false,"not_affected_if":["plugin-not-installed","patched-version","no-contributor-accounts"],"who_is_affected":"Sites running Themify Builder up to and including `7.8.2` where the 'slider' custom post type is active, which happens with any Themify theme. Exposure needs an account with contributor role or higher, so sites with only trusted editors face less risk. Sites without the plugin or on a fixed version can skip it.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000657,"input_tokens":3437,"output_tokens":627,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111726':12A,15A '-2026':11A,14A '7.8.2':94C 'access':54B,114C,130C 'activ':146C 'arbitrari':119C 'attack':49B,109C 'attribut':9A,36B,86C 'authent':108C 'automat':150C 'browser':47B 'builder':2A,22B,26B,71C 'contributor':52B,112C 'contributor-level':51B,111C 'cpt':168C 'cross':80C 'cross-sit':79C 'custom':142C 'cve':10A,13A 'due':95C 'escap':102C 'execut':61B,126C 'exploit':138C 'host':19B 'includ':93C 'inject':67B,118C,132C 'input':98C 'insuffici':97C 'level':53B,113C 'make':104C 'open':65B 'output':101C 'packag':16B 'page':41B,68B,123C,133C 'pair':155C 'plant':56B 'plugin':4A,27B,72C,153C,163C 'possibl':106C 'post':143C 'regist':165C 'run':42B 'sanit':32B,99C 'satisfi':149C 'script':44B,58B,82C,121C 'self':18B 'self-host':17B 'shortcod':8A,35B,85C 'site':81C 'slider':141C,167C 'store':5A,39B,78C 'text':38B 'theme':159C 'themifi':1A,21B,25B,70C,158C 'themify-build':20B 'type':144C 'user':64B,129C 'version':89C 'via':7A,83C 'visibl':34B,84C 'visitor':46B 'vulner':76C,135C 'web':120C 'whenev':62B,127C 'wordpress':3A,23B,29B,74C 'xss':6A","nicknames":[],"mitigations":[],"who_affected":"Sites running Themify Builder up to and including `7.8.2` where the 'slider' custom post type is active, which happens with any Themify theme. Exposure needs an account with contributor role or higher, so sites with only trusted editors face less risk. Sites without the plugin or on a fixed version can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-17T04:16:52+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111726","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111726","severity":null,"published_at":"2026-10-17T04:16:52+00:00","modified_at":"2026-10-19T15:16:45+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}