CVE-2026-111726: Themify Builder <= 7.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'visible' Shortcode Attribute
The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'visible' Shortcode Attribute in all versions up to, and including, 7.8.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the 'slider' custom post type is active, which is satisfied automatically when the plugin is paired with a Themify theme or any other plugin that registers the 'slider' CPT.
Affected Software
Event History
Frequently Asked Questions
Which sites are actually exposed to exploitation?
A site is exploitable only if the slider custom post type is active. This occurs automatically when Themify Builder is used with a Themify theme or with another plugin that registers the slider CPT.
What access does an attacker need?
An attacker must be authenticated and have at least Contributor-level WordPress access. They can inject script through the visible shortcode attribute, and the script executes when someone views the affected page.
Are visitors affected even if they cannot edit content?
Yes. Although injecting the payload requires Contributor-level access or higher, the stored script runs whenever a user accesses an injected page.
How can I determine whether my site may be affected?
Check whether Themify Builder is version 7.8.2 or earlier and whether the slider custom post type is registered and active. Also review pages created or edited by Contributor-level and higher accounts for malicious content using the visible shortcode attribute.