CVE-2026-115869

MEDIUM

MEDIUM Priority: 0.00 BB Relevance: 63/100

Published: 2026-10-30 Modified: 2026-10-30 First seen: 2026-10-30 Status: active

Attack Surface

Network Low Complexity No Interaction Scope Change

CVSS Vector Breakdown

AV: Network

AC: Low

PR: Low

UI: None

S: Changed

C: Low

I: Low

A: None

Description

The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'variations' repeater field of Custom Font (tb_cf) posts in versions up to, and including, 7.8.4. This is due to insufficient input sanitization and output escaping on the variations post meta: Themify_Metabox::_save_meta() only passes the value through wp_kses_data() when the field type is 'textbox' or 'textarea', so the 'repeater' field writes attacker-controlled sub-fields (style, woff/woff2/ttf/svg/eot URLs) to update_post_meta() verbatim, and Themify_Custom_Fonts::render_columns() later echoes those values unescaped inside a <style> block on the Custom Fonts admin listing. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page (specifically, the Custom Fonts admin listing).