A missing sanitization step for the 'visible' shortcode attribute in the Themify Builder plugin allows an authenticated user with contributor privileges or higher to embed arbitrary JavaScript. When stored, the code is rendered within slider posts and executes in any visitor’s browser, enabling defacement, cookie theft, or session hijacking in the context of each affected user.

All WordPress sites running the Themify Builder plugin up to and including version 7.8.2 are impacted, but the flaw only activates when the 'slider' custom post type is enabled, which happens automatically when the plugin is paired with a Themify theme or any other plugin that registers the same CPT.

The CVSS base score is 6.4, classifying the risk as medium‑to‑high. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a WordPress account with contributor or higher access and the presence of the slider CPT; an attacker can inject malicious JavaScript into a slider item, which is then served to every page visitor.