The flaw is found in the Themify Builder plugin for WordPress versions up to and including 7.7.6. It is a Stored Cross‑Site Scripting weakness (CWE‑79) caused by the plugin’s failure to sanitize or escape the contents of the Map Module field named "b_width_map" before storing and later rendering that content. As a result, an authenticated user who has contributor‑level or higher privileges can inject arbitrary JavaScript into that field, which is then saved to the database and executed in the browsers of any visitor who loads the affected page. The CVE description does not enumerate specific downstream actions such as credential theft or defacement, but it indicates that arbitrary script execution is possible if an attacker can gain the necessary authorisation.

WordPress sites that have installed the Themify Builder plugin and are running a version up to and including 7.7.6 are potentially affected. Sites that have upgraded beyond that version have not been reported to remain vulnerable.

The CVSS score of 6.4 places this issue in the medium‑to‑high severity range, while the EPSS score of less than 1% suggests low probability of exploitation based on current public data. Because the vulnerability requires authenticated access, the realistic risk hinges on the site’s role‑assignment policies; a contributor or higher role can perform the exploit. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a legitimate contributor user submitting malicious script in the "b_width_map" field; the injected payload will run automatically for all visitors to the affected page, potentially enabling client‑side compromise.