Plugin security history

Themify Builder Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 14 vulnerability records associated with Themify Builder, published between 2021 and 2026.

Dataset last synchronized: 2026-08-02 09:41:47 UTC

At a glance

Security Snapshot

14Total records

0Critical

2High

12Medium

0Low

0Informational

14Patched records

0Currently marked unpatched

2021-10-04First disclosure

2026-07-15Latest disclosure

13 of 14CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2021	1	1 records
2024	6	6 records
2025	3	3 records
2026	4	4 records

Severity Breakdown

Severity	Records	Share
High	2	14.3%
Medium	12	85.7%

Vulnerability-Type Breakdown

Cross-Site Scripting

8 records57.1%

First: 2021. Latest: 2026.

Missing Authorization

3 records21.4%

First: 2024. Latest: 2026.

Other

2 records14.3%

First: 2024. Latest: 2024.

CSRF

1 record7.1%

First: 2024. Latest: 2024.

Patch Status

Patched: 14
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

7.7.8
7.7.7
7.7.5
7.7.0
7.6.8
7.6.6
7.6.5
7.6.3
7.6.2
7.5.8
7.0.6
5.3.2

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-7.7.7`	Themify Builder <= 7.7.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Stylesheet Write/Delete via tb_generate_on_fly AJAX Action	July 15, 2026	7.7.8	Medium
`*-7.7.6`	Themify Builder <= 7.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map Module 'b_width_map' Field	July 10, 2026	7.7.7	Medium
`*-7.7.6`	Themify Builder <= 7.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'height_slider' Slider Module Field	July 10, 2026	7.7.7	Medium
`*-7.7.4`	Themify Builder <= 7.7.4 - Unauthenticated Stored Cross-Site Scripting	July 7, 2026	7.7.5	High
`*-7.6.9`	Themify Builder <= 7.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting	September 23, 2025	7.7.0	Medium
`*-7.6.7`	Themify Builder <= 7.6.7 - Missing Authorization	August 20, 2025	7.6.8	Medium
`*-7.6.5`	Themify Builder <= 7.6.5 - Reflected Cross-Site Scripting	January 21, 2025	7.6.6	Medium
`*-7.6.3`	Themify Builder <= 7.6.3 - Authenticated (Contributor+) Local File Inclusion	December 19, 2024	7.6.5	High
`*-7.6.5`	Themify Builder <= 7.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting	November 13, 2024	7.6.6	Medium
`*-7.6.2`	Themify Builder <= 7.6.2 - Reflected Cross-Site Scripting	October 4, 2024	7.6.3	Medium
`*-7.6.1`	Themify Builder <= 7.6.1 - Missing Authorization to Authenticated (Contributor+) Post Duplication	August 21, 2024	7.6.2	Medium
`*-7.5.7`	Themify Builder <= 7.5.7 - Open Redirect via 'tb_redirect_fail'	May 23, 2024	7.5.8	Medium
`*-7.0.5`	Themify Builder <= 7.0.5 - Cross-Site Request Forgery	February 5, 2024	7.0.6	Medium
`*-5.3.1`	Themify Builder <= 5.3.1 - Reflected Cross-Site Scripting	October 4, 2021	5.3.2	Medium

Selected source records

Latest Records

MediumCVE-2026-15407

Themify Builder <= 7.7.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Stylesheet Write/Delete via tb_generate_on_fly AJAX Action

Published: July 15, 2026

Affected versions: *-7.7.7
Patched versions: 7.7.8

Original Wordfence record

MediumCVE-2026-15096

Themify Builder <= 7.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map Module 'b_width_map' Field

Published: July 10, 2026

Affected versions: *-7.7.6
Patched versions: 7.7.7

Original Wordfence record

MediumCVE-2026-15097

Themify Builder <= 7.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'height_slider' Slider Module Field

Published: July 10, 2026

Affected versions: *-7.7.6
Patched versions: 7.7.7

Original Wordfence record

HighCVE-2026-57369

Themify Builder <= 7.7.4 - Unauthenticated Stored Cross-Site Scripting

Published: July 7, 2026

Affected versions: *-7.7.4
Patched versions: 7.7.5

Original Wordfence record

MediumCVE-2025-9353

Themify Builder <= 7.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: September 23, 2025

Affected versions: *-7.6.9
Patched versions: 7.7.0

Original Wordfence record

MediumCVE-2025-49396

Themify Builder <= 7.6.7 - Missing Authorization

Published: August 20, 2025

Affected versions: *-7.6.7
Patched versions: 7.6.8

Original Wordfence record

MediumCVE-2024-13319

Themify Builder <= 7.6.5 - Reflected Cross-Site Scripting

Published: January 21, 2025

Affected versions: *-7.6.5
Patched versions: 7.6.6

Original Wordfence record

HighCVE-2024-56216

Themify Builder <= 7.6.3 - Authenticated (Contributor+) Local File Inclusion

Published: December 19, 2024

Affected versions: *-7.6.3
Patched versions: 7.6.5

Original Wordfence record

Highest-Severity Records

HighCVE-2024-56216

Themify Builder <= 7.6.3 - Authenticated (Contributor+) Local File Inclusion

Published: December 19, 2024

Affected versions: *-7.6.3
Patched versions: 7.6.5

Original Wordfence record

HighCVE-2026-57369

Themify Builder <= 7.7.4 - Unauthenticated Stored Cross-Site Scripting

Published: July 7, 2026

Affected versions: *-7.7.4
Patched versions: 7.7.5

Original Wordfence record

MediumCVE-2026-15097

Themify Builder <= 7.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'height_slider' Slider Module Field

Published: July 10, 2026

Affected versions: *-7.7.6
Patched versions: 7.7.7

Original Wordfence record

MediumCVE-2025-9353

Themify Builder <= 7.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: September 23, 2025

Affected versions: *-7.6.9
Patched versions: 7.7.0

Original Wordfence record

MediumCVE-2026-15096

Themify Builder <= 7.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map Module 'b_width_map' Field

Published: July 10, 2026

Affected versions: *-7.7.6
Patched versions: 7.7.7

Original Wordfence record

MediumCVE-2024-52423

Themify Builder <= 7.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: November 13, 2024

Affected versions: *-7.6.5
Patched versions: 7.6.6

Original Wordfence record

MediumCVE-2024-13319

Themify Builder <= 7.6.5 - Reflected Cross-Site Scripting

Published: January 21, 2025

Affected versions: *-7.6.5
Patched versions: 7.6.6

Original Wordfence record

MediumCVE-2024-3032

Themify Builder <= 7.5.7 - Open Redirect via 'tb_redirect_fail'

Published: May 23, 2024

Affected versions: *-7.5.7
Patched versions: 7.5.8

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory