CVE-2026-15097

Name of the Vulnerable Software and Affected Versions Themify Builder versions prior to 7.7.7

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts through the height slider field of the Slider Module. These scripts execute whenever a user visits the affected page.

Recommendations Update the plugin to a version newer than 7.7.6.