CVE-2026-15096 Overview
CVE-2026-15096 is a Stored Cross-Site Scripting (XSS) vulnerability in the Themify Builder plugin for WordPress. The flaw affects all versions up to and including 7.7.6. It resides in the Map Module's b_width_map field, which lacks sufficient input sanitization and output escaping [CWE-79]. Authenticated attackers with contributor-level access or higher can inject arbitrary JavaScript into pages. The injected scripts execute in the browser of any visitor who loads the affected page.
Critical Impact
Authenticated contributors can persist malicious JavaScript in published pages, enabling session theft, administrator account takeover, and redirection of site visitors to attacker-controlled infrastructure.
Affected Products
- Themify Builder plugin for WordPress, all versions through 7.7.6
- WordPress sites permitting contributor-level user registration
- Sites using the Themify Builder Map Module in published content
Discovery Timeline
- 2026-07-11 - CVE-2026-15096 published to the National Vulnerability Database
- 2026-07-13 - Last updated in NVD database
Technical Details for CVE-2026-15096
Vulnerability Analysis
The Themify Builder plugin exposes a Map Module that accepts a b_width_map parameter to configure display width. The plugin stores this attribute in post metadata and later reflects it into rendered HTML without applying context-appropriate escaping. Because the value reaches the browser inside an HTML attribute or inline style context, an attacker can break out of the intended value and inject a <script> tag or event-handler payload. The stored nature of the flaw means the payload executes for every visitor who loads the page, including administrators.
Root Cause
The root cause is missing sanitization on input and missing output escaping on render. The vulnerable data flow passes through class-builder-data-manager.php, class-themify-builder-active.php, and the template-map.php template, where the b_width_map value is emitted without functions such as esc_attr() or esc_html(). WordPress requires plugins to sanitize input on save and escape on output; the Map Module handling of b_width_map does neither for this field.
Attack Vector
An authenticated user with contributor-level privileges creates or edits a post that includes the Map Module. The attacker supplies a crafted value for the b_width_map field containing HTML-breaking characters and JavaScript. When any user loads the resulting page, the payload executes under the site's origin. Successful exploitation can hijack administrator sessions, exfiltrate cookies, alter DOM content, or chain into administrative actions via authenticated fetch requests. The attack requires no user interaction beyond visiting the compromised page.
For technical details on the affected code paths, review the WordPress Themify Builder Class, the WordPress Themify Active Class, and the WordPress Template Map File.
Detection Methods for CVE-2026-15096
Indicators of Compromise
- Post metadata containing b_width_map values with <, >, ", or javascript: sequences
- Unexpected <script>, onerror, or onload tokens rendered in pages using the Map Module
- Outbound browser requests from visitor sessions to unfamiliar domains after loading Themify pages
- Administrator account activity originating from contributor accounts or from unusual IP addresses
Detection Strategies
- Query the wp_postmeta table for Themify Builder rows containing HTML tag delimiters or script keywords in b_width_map
- Inspect rendered HTML of pages using the Map Module for attribute-context injection breakouts
- Review WordPress audit logs for post edits by contributor accounts that add or modify Map Module blocks
- Correlate contributor logins with subsequent administrator session anomalies
Monitoring Recommendations
- Enable WordPress activity logging with post revision capture on all contributor-level accounts
- Deploy a web application firewall rule that blocks HTML metacharacters in Themify Builder module fields
- Monitor egress traffic from browsers viewing Themify-rendered content for beacon patterns
- Alert on new contributor account creation followed by immediate post publication
How to Mitigate CVE-2026-15096
Immediate Actions Required
- Update the Themify Builder plugin to a version later than 7.7.6 once the vendor releases a fix
- Audit all existing posts using the Map Module and remove or sanitize any suspicious b_width_map values
- Restrict contributor-level registration and review existing contributor accounts for legitimacy
- Force password resets and invalidate active sessions for administrator accounts that viewed suspect pages
Patch Information
Refer to the Themify Builder Changeset Log for the code changes addressing this issue. Additional context is available in the Wordfence Vulnerability Report.
Workarounds
- Disable the Themify Builder Map Module in site configuration until patching is complete
- Revoke contributor and author roles from untrusted users, limiting the pool of accounts able to inject
- Deploy a Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
- Place the WordPress admin area behind IP allow-listing or an additional authentication layer
# Example Content Security Policy header for nginx to limit inline script execution
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'" always;
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
