CVE-2026-15096 is a stored cross-site scripting vulnerability in the Themify Builder WordPress plugin, specifically in the Map Module's 'b_width_map' field. The flaw allows authenticated attackers with contributor-level privileges or above to inject arbitrary web scripts into pages. These scripts execute in the context of users who access the compromised pages. The vulnerability is due to improper neutralization of input during web page generation, classified under CWE-79. It affects all versions up to and including 7.7.6. The CVSS 3.1 base score is 6.4, indicating a medium severity with network attack vector, low attack complexity, and no user interaction required.

An attacker with contributor-level access or higher can inject persistent malicious scripts into pages via the vulnerable field. This can lead to unauthorized actions performed in the context of other users, potentially compromising confidentiality and integrity of user data. The vulnerability does not impact availability. The scope is changed (S:C) indicating that the vulnerability affects resources beyond the vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and monitor for suspicious activity related to the Map Module. Avoid using the vulnerable 'b_width_map' field if possible. Follow updates from the Themifyme vendor for patches or official mitigations.