A flaw in the Themify Builder plugin allows authenticated users with Contributor or higher privileges to store malicious JavaScript in the "variations" repeater field of Custom Font posts. The plugin fails to sanitise the sub‑field values and later outputs them unsafely inside a <style> block on the administration page, creating a persistent cross‑site scripting condition. An attacker can inject code that runs whenever an administrator or other users view the Custom Fonts listing, which could be leveraged to execute JavaScript in the context of the logged‑in user.

The issue affects the WordPress plugin Themify Builder, distributed by themifyme, in all releases up to and including version 7.8.4. No information in the report indicates that newer releases have addressed the vulnerability; therefore, sites running any of these versions remain exposed.

The flaw carries a CVSS score of 6.4, indicating medium severity, and no EPSS score is available. The vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated with Contributor privilege or higher. Once stored, the malicious payload is rendered inside a <style> block on the Custom Fonts admin listing page, executing in the context of any user who visits that page. This creates a persistent XSS condition that could enable malicious JavaScript execution for subsequent visitors to the admin page.