{"id":"CVE-2026-115869","kind":"vulnerability","aliases":["CVE-2026-115869"],"related":[],"title":"Themify Builder for WordPress: stored XSS via Custom Font variations field","description":"The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'variations' repeater field of Custom Font (tb_cf) posts in versions up to, and including, 7.8.4. This is due to insufficient input sanitization and output escaping on the variations post meta: Themify_Metabox::_save_meta() only passes the value through wp_kses_data() when the field type is 'textbox' or 'textarea', so the 'repeater' field writes attacker-controlled sub-fields (style, woff/woff2/ttf/svg/eot URLs) to update_post_meta() verbatim, and Themify_Custom_Fonts::render_columns() later echoes those values unescaped inside a <style> block on the Custom Fonts admin listing. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page (specifically, the Custom Fonts admin listing).","summary":"Themify Builder plugin versions up to and including 7.8.4 fail to sanitize the 'variations' repeater field on Custom Font posts, so the value is saved and later echoed unescaped on the Custom Fonts admin page. A contributor-level WordPress user can plant JavaScript that runs in the browser of any user who opens that admin listing.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","themify-builder","wordpress"],"not_affected_if":["auth-required","plugin-not-installed"],"how_to_check":"- Check whether the Themify Builder plugin is installed and its version is `7.8.4` or lower in the WordPress plugin list\n- Confirm whether contributor-level or higher accounts are untrusted users on the site","fix":"- Themify Builder: move to a version later than `7.8.4` (the fixed version is not stated in the sources)","status":"open","published_at":"2026-10-30T18:17:23+00:00","first_seen_at":"2026-10-30T18:55:29+00:00","triaged_at":"2026-10-30T18:57:06+00:00","updated_at":"2026-10-30T18:57:06+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-30T18:57:06Z","model":"claude-haiku-5-5","output":{"fix":"- Themify Builder: move to a version later than `7.8.4` (the fixed version is not stated in the sources)","reach":"network","title":"Themify Builder for WordPress: stored XSS via Custom Font variations field","impact":"medium","summary":"Themify Builder plugin versions up to and including 7.8.4 fail to sanitize the 'variations' repeater field on Custom Font posts, so the value is saved and later echoed unescaped on the Custom Fonts admin page. A contributor-level WordPress user can plant JavaScript that runs in the browser of any user who opens that admin listing.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","themify-builder","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"Injected script runs in admin browsers, stealing sessions or site actions","analyst_note":"Confirm the first fixed Themify Builder version and check the NVD entry for the CVSS vector; the sources give only 'up to and including 7.8.4'.","how_to_check":"- Check whether the Themify Builder plugin is installed and its version is `7.8.4` or lower in the WordPress plugin list\n- Confirm whether contributor-level or higher accounts are untrusted users on the site\n- Unknown whether any specific setting changes exposure","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","auth-required"],"who_is_affected":"Sites running the Themify Builder WordPress plugin at version 7.8.4 or lower. Exploitation needs an account at contributor level or above, and the payload fires when an administrator or editor opens the Custom Fonts listing. Sites where only trusted users can log in, or that do not run the plugin, can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000765,"input_tokens":4367,"output_tokens":657,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115869':14A,17A '-2026':13A,16A '7.8.4':34B,114C 'admin':59B,81B 'attack':156C 'attacker-control':155C 'browser':74B 'builder':2A,24B,27B,85C 'cf':106C 'column':174C 'contributor':63B 'contributor-level':62B 'control':157C 'cross':94C 'cross-sit':93C 'custom':8A,43B,57B,103C,171C 'cve':12A,15A 'data':141C 'due':117C 'echo':53B,176C 'escap':124C 'fail':35B 'field':11A,41B,101C,144C,153C,160C 'font':9A,44B,58B,104C,172C 'host':21B 'includ':33B,113C 'input':120C 'insid':180C 'insuffici':119C 'javascript':69B 'kses':140C 'later':52B,175C 'level':64B 'list':82B 'meta':129C,133C,167C 'metabox':131C 'open':79B 'output':123C 'packag':18B 'page':60B 'pass':135C 'plant':68B 'plugin':28B,86C 'post':45B,107C,128C,166C 'render':173C 'repeat':40B,100C,152C 'run':71B 'sanit':37B,121C 'save':50B,132C 'script':96C 'self':20B 'self-host':19B 'site':95C 'store':5A,92C 'style':161C 'sub':159C 'sub-field':158C 'tb':105C 'textarea':149C 'textbox':147C 'themifi':1A,23B,26B,84C,130C,170C 'themify-build':22B 'type':145C 'unescap':54B,179C 'updat':165C 'url':163C 'user':66B,77B 'valu':48B,137C,178C 'variat':10A,39B,99C,127C 'verbatim':168C 'version':29B,109C 'via':7A,97C 'vulner':90C 'woff/woff2/ttf/svg/eot':162C 'wordpress':4A,25B,65B,88C 'wp':139C 'write':154C 'xss':6A","nicknames":[],"mitigations":[],"who_affected":"Sites running the Themify Builder WordPress plugin at version 7.8.4 or lower. Exploitation needs an account at contributor level or above, and the payload fires when an administrator or editor opens the Custom Fonts listing. Sites where only trusted users can log in, or that do not run the plugin, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T18:17:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115869","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115869","severity":null,"published_at":"2026-10-30T18:17:23+00:00","modified_at":"2026-10-30T18:33:26+00:00","first_seen_at":"2026-10-30T18:55:29+00:00","fetched_at":"2026-10-30T18:55:29+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}