SecAlerts
t

themify

Security Risk Profile

42
/100
medium

Security Risk Score

Comprehensive risk assessment based on 52 vulnerabilities, EPSS scores, exploitation status, and remediation availability.

📅 Data spans from March 18, 2021 to present

52
Total CVEs
18
Critical+High
0
Exploited
11
Unpatched

Threat Assessment

Avg CVSS
6.8
Base severity
Avg EPSS
0%
Exploit probability
Unpatched
11
Critical/High
Risk Level
42/100
medium
🆕 2Fresh (<7d)📈 4 in Last 30 Days

Severity Distribution

Critical
5
High
13
Medium
34
Low
0

Exploit Likelihood

>50% chance
0
20-50%
0
5-20%
0
<5%
15

Age Distribution

Common Weaknesses (CWE)

1
XSS
32
2
CSRF
5
3
Malicious File Upload
4
4
SQL Injection
1

Most Affected Products

1. Themify Themify Builder8
2. Themify Builder WordPress6
3. Themify Woocommerce Product Filter Wordpress5
4. Themify Ultra Wordpress5
5. Themify Portfolio Post WordPress5

Recent Vulnerabilities

See more →
CVE-2026-109989
CVSS 6.4medium

Themify Popup <= 1.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via 'popup_width_unit' Parameter

Oct 17, 2026🔧 No Patch
CVE-2026-111726
CVSS 6.4medium

Themify Builder <= 7.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'visible' Shortcode Attribute

Oct 17, 2026🔧 No Patch
CVE-2026-96831
CVSS 8.8EPSS 0%high

WordPress Themify Builder plugin <= 7.8.1 - PHP Object Injection vulnerability

Sep 30, 2026🔧 No Patch
CVE-2026-95864
CVSS 7.2EPSS 0%high

Themify Builder <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via 'css[fonts]' Parameter

Sep 25, 2026🔧 No Patch
CVE-2026-15407
CVSS 4.3medium

Themify Builder <= 7.7.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Stylesheet Write/Delete via tb_generate_on_fly AJAX Action

Jul 16, 2026🔧 No Patch
CVE-2026-57369
CVSS 7.1high

WordPress Themify Builder plugin <= 7.7.4 - Cross Site Scripting (XSS) vulnerability

Jul 13, 2026🔧 No Patch
CVE-2026-15096
CVSS 6.4medium

Themify Builder <= 7.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map Module 'b_width_map' Field

Jul 11, 2026🔧 No Patch
CVE-2026-15097
CVSS 6.4medium

Themify Builder <= 7.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'height_slider' Slider Module Field

Jul 11, 2026🔧 No Patch
CVE-2025-31013
CVSS 7.1high

WordPress Themify Folo theme <= 1.9.6 - Reflected Cross Site Scripting (XSS) vulnerability

Jun 17, 2026🔧 No Patch
CVE-2026-32449
CVSS 6.5EPSS 0%medium

WordPress Themify Event Post plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability

Mar 13, 2026🔧 No Patch

Monitor themify in Real-Time

Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.

Powered bySecAlerts

Monitor Your Software Stack in Real-Time

Get instant alerts when vulnerabilities are discovered in your software stack. Stay ahead of security threats with SecAlerts.

© 2026 SecAlerts Pty Ltd. All rights reserved.

themify Security Vulnerabilities & Risk Score | 52 CVEs | SecAlerts - SecAlerts