CVE-2026-95864: Themify Builder <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via 'css[fonts]' Parameter
The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'css[fonts]' Parameter in all versions up to, and including, 7.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce required to reach the vulnerable endpoint is embedded in plain sight within the front-end page markup for all visitors, reducing the access control to a CSRF token rather than an authentication barrier and making the endpoint fully exploitable by unauthenticated attackers.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker can exploit it. The required nonce is exposed in front-end page markup available to all visitors, so it does not provide an effective authentication barrier.
What must an attacker do for malicious code to run?
An attacker must inject script content through the css[fonts] parameter into a page. The injected script executes when another user accesses that affected page.
Are installations running version 7.8.1 affected?
Yes. The issue affects all Themify Builder versions up to and including 7.8.1.
How can I determine whether an attack may have succeeded?
Review pages built with Themify Builder for unexpected or unauthorized content associated with font CSS settings, especially script-like payloads. Because the issue is stored XSS, malicious content may persist and execute for visitors opening an injected page.