Themify Builder

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   Themify Builder

Information

Software Type Plugin
Software Slug themify-builder (view on wordpress.org)
Software Status Active
Software Author themifyme
Software Website themify.me
Software Downloads 662,112
Software Active Installs 6,000
Software Record Last Updated October 6, 2026

17 Vulnerabilities

Submit a Vulnerability
Themify Builder <= 7.8.1 - Authenticated (Contributor+) PHP Object Injection
7.5
CVE-2026-96831
Sep 28, 2026
Researcher: Ananda Dhakal
Themify Builder <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via 'css[fonts]' Parameter
7.2
CVE-2026-95864
Sep 24, 2026
Researcher: thevietronin
Themify Builder <= 7.8.0 - Missing Authorization to Unauthenticated Arbitrary Builder Data Modification via 'tb_update_old_data' AJAX Action
5.3
CVE-2026-75027
Aug 21, 2026
Researcher: Wordfence PRISM
Themify Builder <= 7.7.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Stylesheet Write/Delete via tb_generate_on_fly AJAX Action
4.3
CVE-2026-15407
Jul 15, 2026
Researcher: Wordfence PRISM
Themify Builder <= 7.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map Module 'b_width_map' Field
6.4
CVE-2026-15096
Jul 10, 2026
Researcher: Wordfence PRISM
Themify Builder <= 7.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'height_slider' Slider Module Field
6.4
CVE-2026-15097
Jul 10, 2026
Researcher: Wordfence PRISM
Themify Builder <= 7.7.4 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2026-57369
Jul 7, 2026
Researcher: Ananda Dhakal
Themify Builder <= 7.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2025-9353
Sep 23, 2025
Researcher: zer0gh0st
Themify Builder <= 7.6.7 - Missing Authorization
4.3
CVE-2025-49396
Aug 20, 2025
Researcher: Denver Jackson
Themify Builder <= 7.6.5 - Reflected Cross-Site Scripting
6.1
CVE-2024-13319
Jan 21, 2025
Researcher: Colin Xu
Themify Builder <= 7.6.3 - Authenticated (Contributor+) Local File Inclusion
8.8
CVE-2024-56216
Dec 19, 2024
Researcher: João Pedro Soares de Alcântara
Themify Builder <= 7.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-52423
Nov 13, 2024
Researcher: João Pedro Soares de Alcântara
Themify Builder <= 7.6.2 - Reflected Cross-Site Scripting
6.1
CVE-2024-9385
Oct 4, 2024
Researcher: Colin Xu
Themify Builder <= 7.6.1 - Missing Authorization to Authenticated (Contributor+) Post Duplication
4.3
CVE-2024-7836
Aug 21, 2024
Researcher: Peter Thaleikis
Themify Builder <= 7.5.7 - Open Redirect via 'tb_redirect_fail'
6.1
CVE-2024-3032
May 23, 2024
Researcher: Valentin LOBSTEIN
Themify Builder <= 7.0.5 - Cross-Site Request Forgery
4.3
CVE-2024-24872
Feb 5, 2024
Researcher: Dhabaleshwar Das
Themify Builder <= 5.3.1 - Reflected Cross-Site Scripting
6.1
CVE ID Unknown
Oct 4, 2021
Researcher: WPScanTeam
Title Status CVE ID CVSS Researchers Date
Themify Builder <= 7.8.1 - Authenticated (Contributor+) PHP Object Injection Patched CVE-2026-96831 7.5 Ananda Dhakal September 28, 2026
Themify Builder <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via 'css[fonts]' Parameter Patched CVE-2026-95864 7.2 thevietronin September 24, 2026
Themify Builder <= 7.8.0 - Missing Authorization to Unauthenticated Arbitrary Builder Data Modification via 'tb_update_old_data' AJAX Action Patched CVE-2026-75027 5.3 Wordfence PRISM August 21, 2026
Themify Builder <= 7.7.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Stylesheet Write/Delete via tb_generate_on_fly AJAX Action Patched CVE-2026-15407 4.3 Wordfence PRISM July 15, 2026
Themify Builder <= 7.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map Module 'b_width_map' Field Patched CVE-2026-15096 6.4 Wordfence PRISM July 10, 2026
Themify Builder <= 7.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'height_slider' Slider Module Field Patched CVE-2026-15097 6.4 Wordfence PRISM July 10, 2026
Themify Builder <= 7.7.4 - Unauthenticated Stored Cross-Site Scripting Patched CVE-2026-57369 7.2 Ananda Dhakal July 7, 2026
Themify Builder <= 7.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2025-9353 6.4 zer0gh0st September 23, 2025
Themify Builder <= 7.6.7 - Missing Authorization Patched CVE-2025-49396 4.3 Denver Jackson August 20, 2025
Themify Builder <= 7.6.5 - Reflected Cross-Site Scripting Patched CVE-2024-13319 6.1 Colin Xu January 21, 2025
Themify Builder <= 7.6.3 - Authenticated (Contributor+) Local File Inclusion Patched CVE-2024-56216 8.8 João Pedro Soares de Alcântara December 19, 2024
Themify Builder <= 7.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2024-52423 6.4 João Pedro Soares de Alcântara November 13, 2024
Themify Builder <= 7.6.2 - Reflected Cross-Site Scripting Patched CVE-2024-9385 6.1 Colin Xu October 4, 2024
Themify Builder <= 7.6.1 - Missing Authorization to Authenticated (Contributor+) Post Duplication Patched CVE-2024-7836 4.3 Peter Thaleikis August 21, 2024
Themify Builder <= 7.5.7 - Open Redirect via 'tb_redirect_fail' Patched CVE-2024-3032 6.1 Valentin LOBSTEIN May 23, 2024
Themify Builder <= 7.0.5 - Cross-Site Request Forgery Patched CVE-2024-24872 4.3 Dhabaleshwar Das February 5, 2024
Themify Builder <= 5.3.1 - Reflected Cross-Site Scripting Patched 6.1 WPScanTeam October 4, 2021

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation