CVE-2026-111726

Overview

The Themify Builder plugin for WordPress contains a stored cross‑site scripting flaw in the 'visible' shortcode attribute. Authenticated users with contributor‑level access can inject scripts that execute for any visitor to the affected page. The issue exists in all releases up to 7.8.2 and requires the slider custom post type to be active.

Description

The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'visible' Shortcode Attribute in all versions up to, and including, 7.8.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the 'slider' custom post type is active, which is satisfied automatically when the plugin is paired with a Themify theme or any other plugin that registers the 'slider' CPT.

Impact

The vulnerability allows attackers to run arbitrary JavaScript in the context of site visitors, potentially leading to session hijacking, defacement, or data exfiltration. Site administrators and content editors with contributor or higher roles are at risk of becoming vectors. End users may unknowingly execute malicious scripts when viewing compromised pages.

Remediation

Apply the latest Themify Builder update (≥7.8.3) or any vendor‑issued patch. If an update is not immediately available, disable the slider custom post type or remove any plugin that registers it. Additionally, enforce strict content sanitization and monitor site logs for suspicious shortcode usage.

Risk context

The CVE is rated medium (CVSS 6.4) with an EPSS of 0.00193, indicating a low probability of exploitation but a moderate impact if triggered. Defenders should prioritize patching while monitoring for anomalous script injections.

Affected products

• Themify Builder
• WordPress
• Themify Theme
• Slider CPT plugin