CVE-2026-95864: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in themifyme Themify Builder
The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'css[fonts]' Parameter in all versions up to, and including, 7.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce required to reach the vulnerable endpoint is embedded in plain sight within the front-end page markup for all visitors, reducing the access control to a CSRF token rather than an authentication barrier and making the endpoint fully exploitable by unauthenticated attackers.
AI Analysis
Technical Summary
CVE-2026-95864 is a stored cross-site scripting vulnerability in the Themify Builder WordPress plugin affecting all versions up to 7.8.1. The flaw exists due to improper neutralization of input in the 'css[fonts]' parameter, enabling unauthenticated attackers to inject arbitrary scripts that execute when users access the compromised page. The presence of a nonce token in the front-end markup allows attackers to bypass authentication controls, making the endpoint fully exploitable without user credentials.
Potential Impact
Successful exploitation allows unauthenticated attackers to execute arbitrary scripts in the context of users visiting affected pages. This can lead to information disclosure, session hijacking, or other client-side impacts. The vulnerability does not affect availability but compromises confidentiality and integrity at the user level.
Mitigation Recommendations
No official patch or fix is currently documented. Users should monitor the vendor's advisory channels for updates. Until a fix is available, consider disabling or restricting access to the vulnerable functionality or plugin. Implementing web application firewall (WAF) rules to detect and block malicious payloads targeting the 'css[fonts]' parameter may provide temporary mitigation.
CVE-2026-95864: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in themifyme Themify Builder
Description
The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'css[fonts]' Parameter in all versions up to, and including, 7.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce required to reach the vulnerable endpoint is embedded in plain sight within the front-end page markup for all visitors, reducing the access control to a CSRF token rather than an authentication barrier and making the endpoint fully exploitable by unauthenticated attackers.
CVSS v3.1
Score 7.2high
Affected software
themifyme
Themify Builder
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-95864 is a stored cross-site scripting vulnerability in the Themify Builder WordPress plugin affecting all versions up to 7.8.1. The flaw exists due to improper neutralization of input in the 'css[fonts]' parameter, enabling unauthenticated attackers to inject arbitrary scripts that execute when users access the compromised page. The presence of a nonce token in the front-end markup allows attackers to bypass authentication controls, making the endpoint fully exploitable without user credentials.
Potential Impact
Successful exploitation allows unauthenticated attackers to execute arbitrary scripts in the context of users visiting affected pages. This can lead to information disclosure, session hijacking, or other client-side impacts. The vulnerability does not affect availability but compromises confidentiality and integrity at the user level.
Mitigation Recommendations
No official patch or fix is currently documented. Users should monitor the vendor's advisory channels for updates. Until a fix is available, consider disabling or restricting access to the vulnerable functionality or plugin. Implementing web application firewall (WAF) rules to detect and block malicious payloads targeting the 'css[fonts]' parameter may provide temporary mitigation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-09-22T16:58:20.070Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ab62746f7a7c541068154d9
Added to database: 09/25/2026, 07:48:22 UTC
Last enriched: 09/25/2026, 08:02:51 UTC
Last updated: 09/26/2026, 02:48:40 UTC
Views: 22
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.