Skip to content
OpenAdvisories

Vendor

themifyme

33 known vulnerabilities.

Products

Themify Builder 16 Themify – WooCommerce Product Filter 3 Themify Event Post 3 Themify Shortcodes 3 Themify Popup 2 Themify Audio Dock 2 Themify Portfolio Post 1 Conditional Menus 1 Themify Icons 1 Themify Store Locator 1
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • High 8.8
    CVE-2026-96831

    WordPress Themify Builder plugin <= 7.8.1 - PHP Object Injection vulnerability

    Contributor PHP Object Injection in Themify Builder <= 7.8.1 versions.

    themifyme Themify Builder
  • High 7.2
    CVE-2026-95864

    Themify Builder <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via 'css[fonts]' Parameter

    The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'css[fonts]' Parameter in all versions up to, and including, 7.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated…

    themifyme Themify Builder Web / CMS
  • High 7.1
    CVE-2026-57369

    WordPress Themify Builder plugin <= 7.7.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Builder themify-builder allows Reflected XSS.This issue affects Themify Builder: from n/a through <= 7.7.4.

    themifyme Themify Builder
  • High 7.1
    CVE-2025-67533

    WordPress Themify Portfolio Post plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Portfolio Post themify-portfolio-post allows Stored XSS.This issue affects Themify Portfolio Post: from n/a through <= 1.3.0.

    themifyme Themify Portfolio Post
  • High 7.5
    CVE-2025-30831

    WordPress Themify Event Post Plugin <= 1.3.2 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themifyme Themify Event Post themify-event-post allows PHP Local File Inclusion.This issue affects Themify Event Post: from n/a through <=…

    themifyme Themify Event Post