CVE-2026-115869 in Themify Builder Plugin
Summary
by MITRE • 10/30/2026
The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'variations' repeater field of Custom Font (tb_cf) posts in versions up to, and including, 7.8.4. This is due to insufficient input sanitization and output escaping on the variations post meta: Themify_Metabox::_save_meta() only passes the value through wp_kses_data() when the field type is 'textbox' or 'textarea', so the 'repeater' field writes attacker-controlled sub-fields (style, woff/woff2/ttf/svg/eot URLs) to update_post_meta() verbatim, and Themify_Custom_Fonts::render_columns() later echoes those values unescaped inside a <style> block on the Custom Fonts admin listing. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page (specifically, the Custom Fonts admin listing).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/30/2026
The Themify Builder plugin for WordPress contains a critical security flaw identified as Stored Cross-Site Scripting within versions up to 7.8.4. This vulnerability stems from insufficient input sanitization and output escaping mechanisms embedded in the handling of custom font configurations, specifically targeting the variations repeater field associated with Custom Font posts. The core technical deficiency lies in the Themify_Metabox::_save_meta() function, which governs how user-supplied data is processed before storage. This function applies strict filtering via wp_kses_data only when the input field type is explicitly categorized as a textbox or textarea. However, for fields designated as repeaters, such as those used to define font variations, this protective layer is bypassed entirely. Consequently, attacker-controlled sub-fields containing malicious payloads are written directly into the WordPress database through update_post_meta() without any validation or sanitization checks.
The operational impact of this flaw manifests when an authenticated user with contributor-level access or higher interacts with the plugin's administrative interface. By exploiting the lack of filtering on repeater fields, an attacker can inject arbitrary JavaScript code by manipulating specific attributes such as CSS style properties or font file URLs in formats like woff, woff2, ttf, svg, and eot. These malicious payloads are stored persistently within the database rather than being executed immediately upon submission. The execution occurs later when Themify_Custom_Fonts::render_columns() retrieves these unescaped values from the database and echoes them directly inside a style block on the Custom Fonts admin listing page. This means that any administrator or user with sufficient privileges who views this specific administrative page will have their session compromised as the injected script executes in their browser context, potentially leading to account takeover, data exfiltration, or further lateral movement within the WordPress environment.
From an industry standards perspective, this vulnerability aligns closely with CWE-79, which classifies Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific nature of storing malicious scripts in a database for later execution categorizes it under Stored XSS, where the payload persists on the target server and is served to multiple victims over time. In terms of attack vector classification according to MITRE ATT&CK, this flaw facilitates techniques associated with Initial Access via Valid Accounts and Execution through Browser Scripting. The attacker leverages valid credentials to inject code that executes within the trusted context of the WordPress admin dashboard, bypassing many perimeter defenses because the traffic originates from a legitimate domain and user session.
Mitigation strategies must address both immediate remediation and long-term security hygiene. The most effective solution is to upgrade the Themify Builder plugin to version 7.8.5 or later, where developers have presumably implemented proper sanitization for all field types including repeaters. For organizations unable to update immediately due to compatibility constraints, temporary mitigations should include restricting administrative access strictly to trusted individuals and implementing a Web Application Firewall that can detect and block patterns associated with XSS payloads in POST requests targeting the plugin's endpoints. Additionally, enabling Content Security Policy headers on the WordPress installation can help mitigate the impact of any successful injection by restricting script execution sources. Regular auditing of user roles is also recommended to ensure that contributor-level accounts are assigned only to users who genuinely require such privileges, thereby reducing the attack surface available for exploitation.