Description

The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'css[fonts]' Parameter in all versions up to, and including, 7.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce required to reach the vulnerable endpoint is embedded in plain sight within the front-end page markup for all visitors, reducing the access control to a CSRF token rather than an authentication barrier and making the endpoint fully exploitable by unauthenticated attackers.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-09-25T08:16:42.177Z",
  "pubdate": "2026-09-25T08:16:42.177Z",
  "executiveSummary": "The Themify Builder plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability affecting all versions up to and including 7.8.1.\nThe vulnerability arises from improper input sanitization and output escaping within the 'css[fonts]' parameter, allowing for the injection of malicious JavaScript.\nAlthough the endpoint requires a nonce for access, the nonce is publicly exposed in the front-end HTML markup, rendering it ineffective as a security control.\nThis design flaw allows unauthenticated, remote attackers to execute arbitrary scripts in the browsers of users visiting affected pages.\nSuccessful exploitation can lead to session hijacking, unauthorized actions performed on behalf of legitimate users, and the potential compromise of administrative accounts.\nGiven that the exploit requires no prior authentication and can be triggered via a crafted request, the risk level is critical, necessitating immediate remediation for all deployments of the affected plugin.",
  "technicalDetails": "The core vulnerability is identified as Stored Cross-Site Scripting (XSS), stemming from the inadequate sanitization of user-supplied data submitted through the 'css[fonts]' parameter in the Themify Builder plugin.\nThe application fails to properly neutralize executable scripts during the input process, and subsequently fails to employ context-aware output escaping when rendering this data back to the browser.\nThe attack flow begins with the discovery of the target's nonce value, which is embedded directly within the front-end page source code. Because this nonce is accessible to any visitor, it does not function as an authentication barrier but rather as a weak, easily bypassable CSRF token.\nAn unauthenticated attacker can construct a malicious HTTP request targeting the vulnerable endpoint, incorporating a malicious payload into the 'css[fonts]' parameter. Once submitted, this payload is stored persistently in the database.\nWhen any user, including high-privileged administrators, navigates to a page where the compromised CSS font configuration is rendered, the payload is executed within the context of the user's session.\nThe execution of arbitrary JavaScript enables the attacker to manipulate the DOM, exfiltrate sensitive cookies, intercept user data, or perform unauthorized administrative actions, such as creating new rogue user accounts or modifying global plugin configurations.\nThe lack of server-side validation for the 'css[fonts]' parameter ensures that malicious input is accepted without restriction. Furthermore, the absence of Content Security Policy (CSP) headers or adequate input filtering allows the malicious script to run unimpeded in the client's browser.\nThe vulnerability persists across all versions up to 7.8.1, indicating a long-standing weakness in the plugin's data handling architecture. Post-exploitation, an attacker gains a persistent foothold in the victim's browsing environment, capable of further escalating the attack surface by targeting administrative interfaces."
}