CVE-2026-95864

Name of the Vulnerable Software and Affected Versions Themify Builder versions prior to 7.8.2

Description The plugin is subject to Stored Cross-Site Scripting (XSS), a flaw where malicious scripts are permanently stored on the target server. This occurs due to insufficient input sanitization and output escaping via the css[fonts] parameter. Unauthenticated attackers can inject arbitrary web scripts into pages that execute when a user accesses them. The security nonce required to reach the vulnerable endpoint is visible in the front-end page markup, effectively reducing the security barrier to a CSRF token and allowing full exploitation by unauthenticated users.

Recommendations Update the plugin to version 7.8.2 or later.