Live › vulnerability › CVE-2026-115869
Themify Builder plugin versions up to and including 7.8.4 fail to sanitize the 'variations' repeater field on Custom Font posts, so the value is saved and later echoed unescaped on the Custom Fonts admin page. A contributor-level WordPress user can plant JavaScript that runs in the browser of any user who opens that admin listing.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 18:55 UTC. All times on this page are UTC.
Sites running the Themify Builder WordPress plugin at version 7.8.4 or lower. Exploitation needs an account at contributor level or above, and the payload fires when an administrator or editor opens the Custom Fonts listing. Sites where only trusted users can log in, or that do not run the plugin, can skip it.
No product ranges from the sources yet.
7.8.4 or lower in the WordPress plugin list7.8.4 (the fixed version is not stated in the sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'variations' repeater field of Custom Font (tb_cf) posts in versions up to, and including, 7.8.4. This is due to insufficient input sanitization and output escaping on the variations post meta: Themify_Metabox::_save_meta() only passes the value through wp_kses_data() when the field type is 'textbox' or 'textarea', so the 'repeater' field writes attacker-controlled sub-fields (style, woff/woff2/ttf/svg/eot URLs) to update_post_meta() verbatim, and Themify_Custom_Fonts::render_columns() later echoes those values unescaped inside a <style> block on the Custom Fonts admin listing. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page (specifically, the Custom Fonts admin listing).
This page as .md · .json · in your agent: get_signal("CVE-2026-115869")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.