Login Request a demo
TB
Product
Themify Builder
by themifyme · last CVE Oct 17, 2026
15
CVEs
0
On KEV
8.8
Max CVSS
2
New 30D
Vulnerabilities15In the news0Timeline
Severity mix
Critical 0High 3Medium 12Low 0
Severity
All severities15Critical0High3Medium12Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Themify Builder to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-96831
8.8
0%
Sep 30
WordPress Themify Builder plugin <= 7.8.1 - PHP Object Injection vulnerability
Affected: through 7.8.1
CVE-2026-95864
7.2
0%
Sep 25
Themify Builder <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via 'css[fonts]' Parameter
Affected: through 7.8.1
CVE-2026-57369
7.1
0%
Jul 13
WordPress Themify Builder plugin <= 7.7.4 - Cross Site Scripting (XSS) vulnerability
Affected: through 7.7.4
CVE-2024-56216
6.5
0%
Dec 31
WordPress Themify Builder plugin <= 7.6.3 - Local File Inclusion vulnerability
Affected: through 7.6.3
CVE-2026-111726
6.4
0%
Oct 17
Themify Builder <= 7.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'visible' Shortcode Attribute
Affected: through 7.8.2
CVE-2026-15096
6.4
0%
Jul 11
Themify Builder <= 7.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map Module 'b_width_map' Field
Affected: through 7.7.6
CVE-2026-15097
6.4
0%
Jul 11
Themify Builder <= 7.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'height_slider' Slider Module Field
Affected: through 7.7.6
CVE-2025-9353
6.4
0%
Sep 24
Themify Builder <= 7.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
Affected: through 7.6.9
CVE-2024-13319
6.1
0%
Jan 22
Themify Builder <= 7.6.5 - Reflected Cross-Site Scripting
Affected: through 7.6.5
CVE-2024-9385
6.1
0%
Oct 5
Themify Builder <= 7.6.2 - Reflected Cross-Site Scripting
Affected: through 7.6.2
CVE-2024-52423
5.4
0%
Nov 18
WordPress Themify Builder plugin <= 7.6.5 - Cross Site Scripting (XSS) vulnerability
Affected: through 7.6.5
CVE-2026-75027
5.3
1%
Aug 22
Themify Builder <= 7.8.0 - Missing Authorization to Unauthenticated Arbitrary Builder Data Modification via 'tb_update_old_data' AJAX Action
Affected: through 7.8.0
CVE-2026-15407
4.3
0%
Jul 16
Themify Builder <= 7.7.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Stylesheet Write/Delete via tb_generate_on_fly AJAX Action
Affected: through 7.7.7
CVE-2025-49396
4.3
0%
Aug 20
WordPress Themify Builder Plugin <= 7.6.7 - Broken Access Control Vulnerability
Affected: through 7.6.7
CVE-2024-7836
4.3
0%
Aug 22
Themify Builder <= 7.6.1 - Missing Authorization to Authenticated (Contributor+) Post Duplication
Affected: through 7.6.1
Showing 15