---
id: "CVE-2026-115869"
kind: "vulnerability"
aliases: ["CVE-2026-115869"]
title: "Themify Builder for WordPress: stored XSS via Custom Font variations field"
severity: "medium"
cvss: 6.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "themify-builder", "wordpress"]
not_affected_if: ["auth-required", "plugin-not-installed"]
published_at: "2026-10-30T18:17:23+00:00"
first_seen_at: "2026-10-30T18:55:29+00:00"
updated_at: "2026-10-30T18:57:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115869", "first_seen_at": "2026-10-30T18:55:29+00:00"}]
---

# Themify Builder for WordPress: stored XSS via Custom Font variations field

Themify Builder plugin versions up to and including 7.8.4 fail to sanitize the 'variations' repeater field on Custom Font posts, so the value is saved and later echoed unescaped on the Custom Fonts admin page. A contributor-level WordPress user can plant JavaScript that runs in the browser of any user who opens that admin listing.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the Themify Builder plugin is installed and its version is `7.8.4` or lower in the WordPress plugin list
- Confirm whether contributor-level or higher accounts are untrusted users on the site

## Fix

- Themify Builder: move to a version later than `7.8.4` (the fixed version is not stated in the sources)

## Timeline

- 2026-10-30T18:55:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115869

## From the sources

The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'variations' repeater field of Custom Font (tb_cf) posts in versions up to, and including, 7.8.4. This is due to insufficient input sanitization and output escaping on the variations post meta: Themify_Metabox::_save_meta() only passes the value through wp_kses_data() when the field type is 'textbox' or 'textarea', so the 'repeater' field writes attacker-controlled sub-fields (style, woff/woff2/ttf/svg/eot URLs) to update_post_meta() verbatim, and Themify_Custom_Fonts::render_columns() later echoes those values unescaped inside a <style> block on the Custom Fonts admin listing. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page (specifically, the Custom Fonts admin listing).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_