---
id: "CVE-2026-111726"
kind: "vulnerability"
aliases: ["CVE-2026-111726"]
title: "Themify Builder WordPress plugin: stored XSS via shortcode attribute"
severity: "medium"
cvss: 6.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "themify-builder", "wordpress"]
not_affected_if: ["no-contributor-accounts", "patched-version", "plugin-not-installed"]
published_at: "2026-10-17T04:16:52+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-25T03:59:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111726", "first_seen_at": "2026-10-23T21:57:14+00:00"}]
---

# Themify Builder WordPress plugin: stored XSS via shortcode attribute

The Themify Builder plugin for WordPress does not sanitize the 'visible' shortcode attribute, so text stored in pages runs as script in visitors' browsers. An attacker with contributor-level access can plant the script, and it executes whenever a user opens the injected page.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Themify Builder version in the WordPress plugins list or `wp plugin get themify-builder --field=version`
- Check whether the 'slider' custom post type is registered, which happens automatically with a Themify theme or another plugin that registers it
- Look for [slider] or similar shortcodes with a 'visible' attribute in post content

## Fix

- Update Themify Builder to a version later than `7.8.2`, as listed in the vendor's changelog or the WordPress plugin repository
- Until updated, restrict contributor-level accounts to trusted users

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111726

## From the sources

The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'visible' Shortcode Attribute in all versions up to, and including, 7.8.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the 'slider' custom post type is active, which is satisfied automatically when the plugin is paired with a Themify theme or any other plugin that registers the 'slider' CPT.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_