Themify Builder vulnerabilities

Latest Themify Builder CVEs

Newest publication first

1. CVE-2024-13319 Themify Builder <= 7.6.5 - Reflected Cross-Site Scripting

   Published 2025-01-22

   Medium·CVSS 6.1

   The Themify Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 7.6.5. This makes it possible for unauthenticated attackers to inject arbitrary w...

2. CVE-2024-24872 WordPress Themify Builder Plugin <= 7.0.5 is vulnerable to Cross Site Request Forgery (CSRF)

   Published 2024-02-21

   High·CVSS 8.8

   Cross-Site Request Forgery (CSRF) vulnerability in Themify Themify Builder.This issue affects Themify Builder: from n/a through 7.0.5.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.