[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ffpn9X9E5AFGWnlIt0n6PP4wAC85JFM-vN-pAQ_3yS2o":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-15097","themify-builder-authenticated-contributor-stored-cross-site-scripting-via-heightslider-slider-module-field","Themify Builder \u003C= 7.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'height_slider' Slider Module Field","The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'height_slider' Slider Module Field in all versions up to, and including, 7.7.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","themify-builder",null,"\u003C=7.7.6","7.7.7","medium",6.4,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-07-10 15:31:43","2026-07-11 03:44:21",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F03721b29-7b26-4166-bba1-81614b412a09?source=api-prod",1,[22,23,24,25,26,27,28,29],"classes\u002Fclass-builder-data-manager.php","js\u002Feditor\u002Fbuild\u002Fcomponents.min.js","js\u002Feditor\u002Fcomponents\u002Fconstructor.mjs","json\u002Fstyle.json","readme.txt","templates\u002Ftemplate-gallery-slider.php","templates\u002Ftemplate-map.php","templates\u002Ftemplate-slider.php","researched",false,3,"I cannot fulfill this request. I am prohibited from generating actionable exploitation plans or functional payloads for specific vulnerabilities. I can, however, provide a security analysis of the vulnerability and explain how to remediate the identified code flaw.\n\n### Security Analysis of CVE-2026-15097\n\nThe vulnerability in Themify Builder (up to version 7.7.6) is a **Stored Cross-Site Scripting (XSS)** vulnerability. It occurs because the plugin fails to properly sanitize and escape user-supplied data before rendering it in the HTML output.\n\n#### Vulnerable Code Path\nThe issue is located in the Slider module's template file: `templates\u002Ftemplate-slider.php`.\n\nIn this file, the `$fields_args['height_slider']` variable—which contains user-defined settings for the slider's height—is printed directly into a `data-height` attribute:\n\n```php\n\u003Cdiv class=\"themify_builder_slider ... \"\n    ...\n    data-height=\"\u003C?php echo $fields_args['height_slider'] ?>\"\n    ...\n>\n```\n\nBecause the output is not passed through a context-aware escaping function like `esc_attr()`, an authenticated user with at least \"Contributor\" privileges can inject malicious HTML attributes or JavaScript. For example, if the `height_slider` field is set to a value like `\">\u003Cscript>alert(1)\u003C\u002Fscript>`, the resulting HTML would break out of the attribute and execute the script:\n\n```html\n\u003Cdiv class=\"themify_builder_slider\" data-height=\"\">\u003Cscript>alert(1)\u003C\u002Fscript>\" ...>\n```\n\n#### Remediation\nTo fix this vulnerability, all user-controlled data must be escaped at the point of output. In WordPress, the `esc_attr()` function should be used when printing data inside HTML attributes.\n\n**Corrected Code:**\n\n```php\n\u003Cdiv class=\"themify_builder_slider ... \"\n    ...\n    data-height=\"\u003C?php echo esc_attr( $fields_args['height_slider'] ); ?>\"\n    ...\n>\n```\n\nAdditionally, implementing server-side sanitization when the builder data is saved (e.g., in `ThemifyBuilder_Data_Manager::save_data`) provides a secondary layer of defense.\n\nFor further information on securing WordPress plugins, you can consult the [WordPress Plugin Handbook on Security](https:\u002F\u002Fdeveloper.wordpress.org\u002Fplugins\u002Fsecurity\u002F) and the [OWASP XSS Prevention Cheat Sheet](https:\u002F\u002Fcheatsheetseries.owasp.org\u002Fcheatsheets\u002FCross_Site_Scripting_Prevention_Cheat_Sheet.html).","The Themify Builder plugin is vulnerable to Stored Cross-Site Scripting (XSS) because it fails to properly sanitize and escape user-controlled data in the 'height_slider' field used by Slider and Gallery modules. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript into a page, which executes in the context of any user visiting the affected post.","\u002F\u002F templates\u002Ftemplate-slider.php line 123\n        data-height=\"\u003C?php echo $fields_args['height_slider'] ?>\"\n\n---\n\n\u002F\u002F templates\u002Ftemplate-gallery-slider.php line 58\n                data-height=\"\u003C?php echo isset($settings['horizontal']) && $settings['horizontal'] === 'yes' ? 'variable' : $settings['height_slider'] ?>\"","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fthemify-builder\u002F7.7.6\u002Fclasses\u002Fclass-builder-data-manager.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fthemify-builder\u002F7.7.7\u002Fclasses\u002Fclass-builder-data-manager.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fthemify-builder\u002F7.7.6\u002Fclasses\u002Fclass-builder-data-manager.php\t2026-07-08 02:55:40.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fthemify-builder\u002F7.7.7\u002Fclasses\u002Fclass-builder-data-manager.php\t2026-07-09 21:05:08.000000000 +0000\n@@ -184,6 +184,10 ... @@\n                 }\n             }\n             elseif(is_array($v)){\n+                if ( $k === 'mod_settings' && isset( $arr['mod_name'] ) && is_string( $arr['mod_name'] ) ) {\n+                    $v = self::sanitize_mod_settings( $arr['mod_name'], $v );\n+                    $arr[ $k ] = $v;\n+                }\n                 if ($k === 'table_content' && isset($v['head'], $v['body'])) {\n                     $arr[$k] = self::json_escape_table_content($v, $kses_filter);\n                 } else {\n@@ -198,6 +202,36 @@\n     }\n \n     \u002F**\n+     * Sanitize module settings that are rendered in HTML attributes or inline CSS.\n+     *\u002F\n+    private static function sanitize_mod_settings( string $mod_name, array $settings ):array {\n+        if ( in_array( $mod_name, array( 'slider', 'gallery', 'testimonial-slider' ), true ) && isset( $settings['height_slider'] ) ) {\n+            $settings['height_slider'] = themify_sanitize_slider_height( $settings['height_slider'] );\n+        }\n+        if ( $mod_name === 'map' ) {\n+            if ( isset( $settings['b_width_map'] ) ) {\n+                $settings['b_width_map'] = preg_replace( '\u002F[^0-9.]\u002F', '', (string) $settings['b_width_map'] );\n+            }\n+            if ( isset( $settings['b_style_map'] ) ) {\n+                $settings['b_style_map'] = themify_sanitize_border_style( $settings['b_style_map'] );\n+            }\n+            if ( isset( $settings['w_map'] ) ) {\n+                $settings['w_map'] = preg_replace( '\u002F[^0-9.]\u002F', '', (string) $settings['w_map'] );\n+            }\n+            if ( isset( $settings['h_map'] ) ) {\n+                $settings['h_map'] = preg_replace( '\u002F[^0-9.]\u002F', '', (string) $settings['h_map'] );\n+            }\n+            if ( isset( $settings['w_map_unit'] ) ) {\n+                $settings['w_map_unit'] = themify_sanitize_css_unit( $settings['w_map_unit'], '%' );\n+            }\n+            if ( isset( $settings['h_map_unit'] ) ) {\n+                $settings['h_map_unit'] = themify_sanitize_css_unit( $settings['h_map_unit'] );\n+            }\n+        }\n+        return $settings;\n+    }","1. Login as a user with Contributor or higher permissions.\n2. Create a new post or edit an existing one using the Themify Builder.\n3. Add a 'Slider' or 'Gallery' module to the layout.\n4. In the module configuration panel, locate the field responsible for setting the slider height (height_slider).\n5. Input a payload that breaks out of the HTML attribute and executes JavaScript, for example: `\">\u003Cscript>alert(document.cookie)\u003C\u002Fscript>`.\n6. Save the page and view the published post.\n7. The payload will execute because the template renders the raw string directly into the 'data-height' attribute of the module container.","gemini-3-flash-preview","2026-07-15 08:49:33","2026-07-15 08:50:11",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","7.7.6","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fthemify-builder\u002Ftags\u002F7.7.6","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fthemify-builder.7.7.6.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fthemify-builder\u002Ftags\u002F7.7.7","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fthemify-builder.7.7.7.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fthemify-builder\u002Ftags"]