Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

Themify Builder — Vulnerabilities & Security Advisories 13

All 13 CVE vulnerabilities found in Themify Builder, with AI-generated Chinese analysis, references, and POCs.

This page aggregates known security weaknesses for Themify Builder, a WordPress page builder plugin developed by Themify. It compiles vulnerability records ranging from early releases up to the present, covering issues identified by vendors, researchers, and automated scanners. The collection includes information on common weakness categories such as cross-site scripting, insecure direct object references, and improper access control, ensuring a comprehensive view of the plugin’s security posture over time. Readers can use this resource to track advisories issued by the vendor, analyze trends in specific weakness classes, and review the full vulnerability history of Themify Builder. This helps security professionals assess the impact of known flaws, verify patch status, and understand how different vulnerability types have affected the product. By centralizing this data, the page serves as a reference for evaluating risk, planning remediation efforts, and comparing the plugin’s security track record against industry standards. The information is structured to support quick lookup, detailed analysis, and informed decision-making for developers and site administrators. All entries are sourced from publicly available advisories, CVE databases, and vendor notifications, maintaining accuracy and relevance. This approach ensures that users have access to reliable, up-to-date insights without navigating multiple disparate sources. The goal is to enhance transparency and facilitate proactive security management for environments relying on Themify Builder.

Vendor: Themify

CVE IDTitleCVSSSeverityPublished
CVE-2026-15407 Themify Builder <= 7.7.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Stylesheet Write/Delete via tb_generate_on_fly AJAX Action CWE-862 4.3 Medium2026-07-16
CVE-2026-57369 WordPress Themify Builder plugin <= 7.7.4 - Cross Site Scripting (XSS) vulnerability CWE-79 7.1 High2026-07-13
CVE-2026-15096 Themify Builder <= 7.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map Module 'b_width_map' Field CWE-79 6.4 Medium2026-07-11
CVE-2026-15097 Themify Builder <= 7.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'height_slider' Slider Module Field CWE-79 6.4 Medium2026-07-11
CVE-2025-9353 Themify Builder <= 7.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting CWE-79 6.4 Medium2025-09-24
CVE-2025-49396 WordPress Themify Builder Plugin <= 7.6.7 - Broken Access Control Vulnerability CWE-862 4.3 Medium2025-08-20
CVE-2024-13319 Themify Builder <= 7.6.5 - Reflected Cross-Site Scripting CWE-79 6.1 Medium2025-01-22
CVE-2024-56216 WordPress Themify Builder plugin <= 7.6.3 - Local File Inclusion vulnerability CWE-98 6.5 Medium2024-12-31
CVE-2024-52423 WordPress Themify Builder plugin <= 7.6.5 - Cross Site Scripting (XSS) vulnerability CWE-79 6.5 Medium2024-11-18
CVE-2024-9385 Themify Builder <= 7.6.2 - Reflected Cross-Site Scripting CWE-79 6.1 Medium2024-10-05
CVE-2024-7836 Themify Builder <= 7.6.1 - Missing Authorization to Authenticated (Contributor+) Post Duplication CWE-863 4.3 Medium2024-08-22
CVE-2024-3032 Themify Builder < 7.5.8 - Open Redirect 6.1AIMediumAI2024-06-13
CVE-2024-24872 WordPress Themify Builder Plugin <= 7.0.5 is vulnerable to Cross Site Request Forgery (CSRF) CWE-352 4.3 Medium2024-02-21

All 13 known CVE vulnerabilities affecting Themify Builder with full Chinese analysis, references, and POCs where available.