CVE-2026-15097: Themify Builder WordPress XSS Vulnerability

CVE-2026-15097 Overview

CVE-2026-15097 is a Stored Cross-Site Scripting (XSS) vulnerability in the Themify Builder plugin for WordPress. The flaw affects all versions up to and including 7.7.6 and resides in the height_slider field of the Slider Module. The plugin fails to properly sanitize input and escape output when rendering slider content, allowing authenticated users with contributor-level access or above to inject arbitrary JavaScript. Injected scripts execute in the browser of any visitor who loads the affected page. The vulnerability is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Authenticated contributors can inject persistent JavaScript that executes in the context of site visitors and administrators, enabling session theft, privilege escalation via administrative actions, and site defacement.

Affected Products

Themify Builder plugin for WordPress — all versions through 7.7.6
WordPress sites permitting contributor-level (or higher) account registration
Any page rendering the Slider Module with attacker-controlled height_slider content

Discovery Timeline

2026-07-11 - CVE-2026-15097 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-15097

Vulnerability Analysis

The Themify Builder plugin exposes a page-building interface that stores module configuration data in post metadata. The Slider Module accepts a height_slider field intended to control the pixel height of slider elements. The plugin persists this value through the builder data manager and later renders it into the front-end slider template without applying context-appropriate escaping. Because the value is written directly into rendered HTML, an attacker can supply markup or event-handler payloads instead of a numeric height. The stored payload executes whenever any user, including administrators, loads a page containing the crafted slider.

Root Cause

The root cause is insufficient input sanitization in class-builder-data-manager.php and missing output escaping in template-slider.php. The plugin trusts the height_slider value as it flows from the builder save routine through storage to template rendering. No call to esc_attr(), absint(), or an equivalent WordPress escaping function constrains the value to a safe numeric or attribute context.

Attack Vector

An attacker first obtains a WordPress account with contributor privileges or higher. Using the Themify Builder editor, the attacker creates or edits a page containing a Slider Module and supplies a malicious payload in the height_slider field. The payload can break out of the intended attribute context and inject a <script> block or an event handler such as onerror or onmouseover. Once the page is published or previewed by a privileged reviewer, the script runs in the victim's browser session. This enables cookie theft, forced administrative actions via CSRF-like abuse, or injection of persistent backdoors through the WordPress REST API.

For technical details on the vulnerable code paths, see the Themify Builder data manager source and the slider template rendering code.

Detection Methods for CVE-2026-15097

Indicators of Compromise

Post metadata entries for the Themify Builder containing <script>, javascript:, or HTML event handlers such as onerror= or onload= inside the height_slider field.
Unexpected outbound requests from browsers loading affected pages to attacker-controlled domains.
New administrator accounts or modified user roles created shortly after a contributor edited a page containing a Slider Module.
WordPress audit log entries showing contributor-level users editing or publishing pages with slider components.

Detection Strategies

Query the wp_postmeta table for Themify Builder serialized data containing HTML tag characters within slider height fields.
Deploy a web application firewall rule to inspect POST requests to admin-ajax.php and the builder save endpoint for non-numeric values in height_slider parameters.
Scan rendered HTML of published pages for inline <script> blocks originating from slider markup rather than legitimate theme assets.

Monitoring Recommendations

Alert on any WordPress role assignment or capability change following contributor content activity.
Monitor Content Security Policy (CSP) violation reports for inline script executions on pages built with Themify Builder.
Track edits performed by low-privilege users on pages later viewed by administrators.

How to Mitigate CVE-2026-15097

Immediate Actions Required

Update the Themify Builder plugin to a version later than 7.7.6 as soon as the vendor releases a patched release referenced in the Wordfence advisory.
Audit all existing pages built with the Slider Module for suspicious content in the height_slider field and remove any injected payloads.
Review and reduce the number of accounts holding contributor-or-higher roles, and rotate credentials for any accounts of uncertain trust.

Patch Information

The vendor addressed the issue in the changeset published as Themify Builder changeset 3601964. Administrators should upgrade to the fixed release available through the WordPress plugin repository. Consult the Wordfence vulnerability report for the confirmed fixed version and additional remediation guidance.

Workarounds

Restrict user registration and require administrator approval before granting contributor or higher roles.
Deploy a Content Security Policy that disallows inline scripts and unsafe event handlers on front-end pages.
Temporarily disable the Themify Builder Slider Module on production sites until the plugin is upgraded.
Apply a WAF virtual patch that rejects non-numeric values submitted to the height_slider parameter.

bash

# Example WAF rule (ModSecurity) blocking non-numeric height_slider values
SecRule ARGS:height_slider "!@rx ^[0-9]+$" \
    "id:1015097,phase:2,deny,status:403,\
     msg:'CVE-2026-15097 Themify Builder height_slider XSS attempt'"