The vulnerability allows an attacker with Contributor or higher access in the Themify Builder plugin to store malicious script code in editable fields. When any user visits the affected page, the injected scripts run in that user’s browser, compromising confidentiality, integrity, or availability of the site. The weakness arises from insufficient input sanitization and output escaping, a classic Cross‑Site Scripting flaw (CWE‑79).

The flaw is present in all versions of the Themify Builder plugin for WordPress up to and including 7.6.9. The plugin is developed by themifyme and any WordPress site using a vulnerable version is affected.

The CVSS score of 6.4 indicates moderate severity, while the EPSS score below 1 % suggests a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated user with Contributor‑level or higher privileges; the attacker must submit malicious content that is then rendered for all visitors to the page.