CVE-2026-15096

Name of the Vulnerable Software and Affected Versions Themify Builder versions prior to 7.7.7

Description Insufficient input sanitization and output escaping in the Map Module allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. This is achieved by injecting arbitrary web scripts through the b width map field, which then execute when a user visits the affected page.

Recommendations Update the plugin to a version newer than 7.7.6. As a temporary mitigation, restrict access to the b width map field in the Map Module for users with contributor-level permissions.