themifyme has 5 CVEs on record. 5 were published in the last 90 days. The busiest recent month was September 2026 with 3. The median CVSS is 6.4 (medium). None have a confirmed exploitation report. The most common weakness class is CWE-79 (4). Most affected products: Themify Builder (2), Themify Popup (1), Themify – WooCommerce Product Filter (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.4
- Publish → KEV
- —
- Last 90 days
- 5 prev 0
Products
- Themify Builder 2
- Themify Popup 1
- Themify – WooCommerce Product Filter 1
- themify-builder 1
Worst active — by depth score
CVE-2026-96831High· 8.8Contributor PHP Object Injection in Themify Builder <= 7.8.1 versions.48CVE-2026-95864High· 7.2The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'css[fonts]' Parameter in all versions up to, and including, 7.8.1 due to insufficient input sanitization and output escaping40CVE-2026-111726Medium· 6.4Themify Builder <= 7.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'visible' Shortcode Attribute35CVE-2026-109989Medium· 6.4Themify Popup <= 1.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via 'popup_width_unit' Parameter35CVE-2026-78172Medium· 6.1Themify – WooCommerce Product Filter <= 1.5.5 - Reflected Cross-Site Scripting34
themifyme vulnerabilities
CVEs affecting themifyme, newest first. Open any entry for full detail, references, and exploit status.
5 CVEsRSS
CVE-2026-111726Medium· 6.4Themify Builder <= 7.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'visible' Shortcode Attribute
The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'visible' Shortcode Attribute in all versions up to, and including, 7.8.2 due to insufficient input sanitization and output escaping. This makes it…
CVE-2026-109989Medium· 6.4Themify Popup <= 1.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via 'popup_width_unit' Parameter
The Themify Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'popup_width_unit' parameter in all versions up to, and including, 1.4.7 due to insufficient input sanitization and output escaping. This makes i…
CVE-2026-96831High· 8.8Contributor PHP Object Injection in Themify Builder <= 7.8.1 versions.
Contributor PHP Object Injection in Themify Builder <= 7.8.1 versions.
CVE-2026-95864High· 7.2The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'css[fonts]' Parameter in all versions up to, and including, 7.8.1 due to insufficient input sanitization and output escaping
The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'css[fonts]' Parameter in all versions up to, and including, 7.8.1 due to insufficient input sanitization and output escaping. This makes it possib…
CVE-2026-78172Medium· 6.1Themify – WooCommerce Product Filter <= 1.5.5 - Reflected Cross-Site Scripting
The Themify – WooCommerce Product Filter plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via Query Parameter Name in all versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping…