CVE-2026-111726 in Themify Builder Plugin
Summary
by MITRE • 10/17/2026
The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'visible' Shortcode Attribute in all versions up to, and including, 7.8.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the 'slider' custom post type is active, which is satisfied automatically when the plugin is paired with a Themify theme or any other plugin that registers the 'slider' CPT.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/17/2026
The Themify Builder plugin for WordPress contains a critical security flaw identified as Stored Cross-Site Scripting within its shortcode attribute handling mechanisms. Specifically, the vulnerability resides in the processing of the visible attribute associated with shortcodes used to construct page layouts and content elements. This issue persists across all versions up to and including 7.8.2, stemming from insufficient input sanitization and a lack of proper output escaping during the rendering process. When an attacker successfully injects malicious script payloads into this specific shortcode parameter, the application fails to neutralize these inputs before they are processed by the browser. Consequently, any user who views a page containing the compromised content will have their session hijacked or interact with unintended elements controlled by the injected scripts. The severity of this vulnerability is compounded by its stored nature, meaning the malicious code persists on the server and executes repeatedly for every visitor, rather than requiring immediate interaction to trigger an exploit in a single session.
The exploitation requirements for this vulnerability are specific yet achievable within typical WordPress environments. An attacker must possess authenticated access with at least contributor-level privileges or higher. This threshold is significant because it allows users who manage content but do not necessarily have administrative control over the entire site infrastructure to introduce malicious code. The attack vector relies on the presence of a custom post type named slider. While this feature might seem niche, it is often enabled automatically when the Themify Builder plugin is used in conjunction with any Themify theme or other plugins that register the slider custom post type as part of their functionality. Therefore, many installations are susceptible to this flaw without explicit configuration changes by the administrator. The attacker injects the payload through legitimate-looking content updates, leveraging the trusted context of the WordPress dashboard and frontend display mechanisms to bypass standard security expectations regarding user-generated content.
From an operational impact perspective, successful exploitation leads to a compromise of client-side integrity for all visitors accessing affected pages. Attackers can utilize this access to steal session cookies, perform actions on behalf of authenticated users such as changing passwords or publishing malicious posts, and redirect victims to phishing sites designed to harvest credentials. In more sophisticated attacks, the injected scripts could be used to deface websites or distribute malware by loading external payloads from remote servers controlled by the attacker. The persistent nature of stored XSS means that even after the initial injection is discovered, existing pages remain compromised until manually corrected, leading to prolonged exposure and potential data loss for site owners and their audiences alike. This represents a significant risk to user privacy and trust in web applications built on this platform.
To mitigate these risks, immediate action is required by updating the Themify Builder plugin to version 7.8.3 or later where the input sanitization and output escaping logic has been corrected. Administrators should verify that all instances of the visible shortcode attribute are free from malicious content if an update cannot be applied immediately. Implementing a Web Application Firewall can provide an additional layer of defense by filtering out known XSS patterns in HTTP requests before they reach the application logic. Furthermore, enforcing strict role-based access control ensures that only trusted administrators with elevated privileges can modify critical site structures and shortcodes, reducing the attack surface available to lower-privileged users like contributors. Regular security audits and code reviews focusing on output escaping practices are essential for maintaining long-term resilience against such injection attacks in WordPress ecosystems aligned with industry standards such as CWE-79 and MITRE ATT&CK techniques related to client-side evasion.