Themifyme vulnerabilities

Products

• Themify Builder 18
• Themify Portfolio Post 6
• Themify Shortcodes 5
• Themify Event Post 4
• Themify Popup 3
• Themify – Woocommerce Product Filter 3
• Conditional Menus 2
• Themify Audio Dock 2
• Themify Icons 2

Newest

• themifyme themify builder Themify Builder <= 7.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'variations' Repeater Field CVE-2026-115869 6.4 MediumOctober 30, 2026
• themifyme themify popup Themify Popup <= 1.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via 'popup_width_unit' Parameter CVE-2026-109989 6.4 MediumOctober 17, 2026
• themifyme themify builder Themify Builder <= 7.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'visible' Shortcode Attribute CVE-2026-111726 6.4 MediumOctober 17, 2026
• themifyme themify builder WordPress Themify Builder plugin <= 7.8.1 - PHP Object Injection vulnerability CVE-2026-96831 8.8 HighSeptember 30, 2026
• themifyme themify builder Themify Builder <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via 'css[fonts]' Parameter CVE-2026-95864 7.2 HighSeptember 25, 2026
• themifyme themify – woocommerce product filter Themify – WooCommerce Product Filter <= 1.5.5 - Reflected Cross-Site Scripting CVE-2026-78172 6.1 MediumSeptember 11, 2026
• themifyme themify builder Themify Builder <= 7.8.0 - Missing Authorization to Unauthenticated Arbitrary Builder Data Modification via 'tb_update_old_data' AJAX Action CVE-2026-75027 5.3 MediumAugust 22, 2026
• themifyme themify builder Themify Builder <= 7.7.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Stylesheet Write/Delete via tb_generate_on_fly AJAX Action CVE-2026-15407 4.3 MediumJuly 16, 2026
• themifyme themify builder WordPress Themify Builder plugin <= 7.7.4 - Cross Site Scripting (XSS) vulnerability CVE-2026-57369 7.1 HighJuly 13, 2026
• themifyme themify builder Themify Builder <= 7.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map Module 'b_width_map' Field CVE-2026-15096 6.4 MediumJuly 11, 2026
• themifyme themify builder Themify Builder <= 7.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'height_slider' Slider Module Field CVE-2026-15097 6.4 MediumJuly 11, 2026
• themify popup, themifyme themify popup +1 more WordPress Themify Popup plugin <= 1.4.3 - PHP Object Injection vulnerability CVE-2026-56037 8.8 HighJuly 2, 2026
• themifyme conditional menus Conditional Menus <= 1.2.6 - Cross-Site Request Forgery to Menu Options Update CVE-2026-1032 4.3 MediumMarch 26, 2026
• themifyme themify event post WordPress Themify Event Post plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability CVE-2026-32449 6.5 MediumMarch 13, 2026
• themifyme themify portfolio post WordPress Themify Portfolio Post plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability CVE-2025-67533 7.1 HighDecember 9, 2025
• themifyme themify builder Themify Builder <= 7.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2025-9353 6.4 MediumSeptember 24, 2025
• themifyme themify popup WordPress Themify Popup Plugin <= 1.4.2 - Cross Site Scripting (XSS) Vulnerability CVE-2025-58787 6.5 MediumSeptember 5, 2025
• themifyme themify icons WordPress Themify Icons Plugin <= 2.0.3 - Cross Site Scripting (XSS) Vulnerability CVE-2025-49395 6.5 MediumAugust 20, 2025
• themifyme themify audio dock WordPress Themify Audio Dock Plugin <= 2.0.5 - Cross Site Scripting (XSS) Vulnerability CVE-2025-49392 5.9 MediumAugust 20, 2025
• themifyme themify builder WordPress Themify Builder Plugin <= 7.6.7 - Broken Access Control Vulnerability CVE-2025-49396 4.3 MediumAugust 20, 2025
• themifyme themify shortcodes WordPress Themify Shortcodes plugin <= 2.1.3 - Cross Site Scripting (XSS) Vulnerability CVE-2025-39581 6.5 MediumApril 16, 2025
• themifyme themify event post WordPress Themify Event Post Plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability CVE-2025-30832 6.5 MediumMarch 27, 2025
• themifyme themify event post WordPress Themify Event Post Plugin <= 1.3.2 - Local File Inclusion vulnerability CVE-2025-30831 7.5 HighMarch 27, 2025
• themify builder, themifyme themify builder +1 more Themify Builder <= 7.6.5 - Reflected Cross-Site Scripting CVE-2024-13319 6.1 MediumJanuary 22, 2025
• themifyme themify audio dock WordPress Themify Audio Dock plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability CVE-2024-56239 6.5 MediumJanuary 2, 2025
• themify builder, themifyme themify builder +1 more WordPress Themify Builder plugin <= 7.6.3 - Local File Inclusion vulnerability CVE-2024-56216 6.5 MediumDecember 31, 2024
• themify store locator, themifyme themify store locator +1 more Themify Store Locator <= 1.1.9 - Cross-Site Request Forgery CVE-2024-12414 4.3 MediumDecember 13, 2024
• themify builder, themifyme themify builder +1 more WordPress Themify Builder plugin <= 7.6.5 - Cross Site Scripting (XSS) vulnerability CVE-2024-52423 6.5 MediumNovember 18, 2024
• themify woocommerce product filter, themifyme themify – woocommerce product filter +1 more WordPress Themify plugin <= 1.5.1 - Cross Site Scripting (XSS) vulnerability CVE-2024-44046 5.9 MediumOctober 6, 2024
• themify builder, themifyme themify builder +1 more Themify Builder <= 7.6.2 - Reflected Cross-Site Scripting CVE-2024-9385 6.1 MediumOctober 5, 2024
• themify builder, themifyme themify builder +1 more Themify Builder <= 7.6.1 - Missing Authorization to Authenticated (Contributor+) Post Duplication CVE-2024-7836 4.3 MediumAugust 22, 2024
• themify shortcodes, themifyme themify shortcodes +1 more WordPress Themify Shortcodes plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerability CVE-2024-43133 6.5 MediumAugust 12, 2024
• themify product filter, woocommerce product filter, themifyme themify – woocommerce product filter +2 more Themify - WooCommerce Product Filter <= 1.4.9 - Unauthenticated SQL Injection via conditions Parameter CVE-2024-6027 9.8 CriticalJune 21, 2024
• themify builder, themifyme themify builder +1 more Themify Builder < 7.5.8 - Open Redirect CVE-2024-3032 6.1 MediumJune 13, 2024
• themify shortcodes, themifyme themify shortcodes +1 more Themify Shortcodes <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via themify_button Shortcode CVE-2024-4567 6.4 MediumMay 9, 2024
• themify event post, themifyme themify event post +1 more WordPress Themify Event Post plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerability CVE-2024-30440 5.9 MediumMarch 29, 2024
• themify shortcodes, themifyme themify shortcodes +1 more Themify Shortcodes <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-2732 5.4 MediumMarch 26, 2024
• themify builder, themifyme themify builder +1 more WordPress Themify Builder Plugin <= 7.0.5 is vulnerable to Cross Site Request Forgery (CSRF) CVE-2024-24872 4.3 MediumFebruary 21, 2024
• themify icons, themifyme themify icons +1 more WordPress Themify Icons Plugin <= 2.0.1 is vulnerable to Cross Site Scripting (XSS) CVE-2023-51693 6.5 MediumFebruary 1, 2024
• themify conditional menus Conditional Menus < 1.2.1 - Reflected XSS CVE-2023-2654 6.1 MediumJune 19, 2023
• themify portfolio post, themifyme themify portfolio post +1 more WordPress Themify Portfolio Post Plugin <= 1.2.4 is vulnerable to Cross Site Scripting (XSS) CVE-2022-32970 4.1 MediumMay 10, 2023
• themify portfolio post, themifyme themify portfolio post +1 more Themify Portfolio Post < 1.2.2 - Contributor+ Stored XSS CVE-2023-0362 5.4 MediumFebruary 13, 2023
• themify shortcodes, themifyme themify shortcodes +1 more Themify Shortcodes < 2.0.8 - Contributor+ Stored XSS via Shortcode CVE-2022-4787 5.4 MediumJanuary 30, 2023
• themify portfolio post, themifyme themify portfolio post +1 more Themify Portfolio Post < 1.2.1 - Contributor+ Stored XSS CVE-2022-4464 5.4 MediumJanuary 16, 2023
• themify portfolio post, themifyme themify portfolio post +1 more Themify Portfolio Post < 1.1.7 - Reflected Cross-Site Scripting CVE-2022-0200 5.4 MediumFebruary 14, 2022
• themify portfolio post, themifyme themify portfolio post +1 more Themify Portfolio Post < 1.1.6 - Authenticated Stored Cross-Site Scripting CVE-2021-24129 5.4 MediumMarch 18, 2021