Stored XSS in Themify Builder via css[fonts] Parameter

Themify Builder, a popular WordPress plugin, contains a Stored Cross-Site Scripting (XSS) vulnerability in versions 7.8.1 and earlier, tracked as CVE-2026-95864. The flaw exists within the 'css[fonts]' parameter, which fails to adequately sanitize user-supplied input or escape output.

The security impact is compounded by the fact that the required nonce is embedded within the site's front-end markup, accessible to any visitor. This effectively bypasses standard authentication requirements, allowing unauthenticated remote attackers to inject arbitrary web scripts into pages. When an authorized user or administrator accesses a compromised page, the injected script executes within the context of their session. This can lead to session hijacking, unauthorized administrative actions, or the redirection of users to malicious infrastructure. Defenders should prioritize updating the plugin to a patched version once available and monitor web server access logs for anomalous POST requests directed at plugin-related endpoints.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the browser of any user viewing the injected content. This could result in unauthorized administrative actions, sensitive information disclosure via session theft, or the compromise of user accounts. The vulnerability affects all WordPress instances running Themify Builder 7.8.1 and earlier.

Recommendation

• Monitor web server logs for suspicious POST requests containing unusual patterns in the 'css[fonts]' parameter.
• Implement a Content Security Policy (CSP) to mitigate the impact of XSS by restricting the sources from which scripts can be executed.
• Upgrade Themify Builder to the latest version immediately upon the release of a security patch by the vendor.