Improper neutralization of input during web page generation exposes a reflected XSS flaw in the Themify Builder plugin for WordPress. Because the plugin outputs user‑supplied data without proper encoding, an attacker can embed malicious JavaScript that executes in a victim’s browser is identified as CWE‑79 and is triggered by reflected input fields that the plugin echoes back verbatim.

The flaw exists in the Themify Builder WordPress plugin distributed by themifyme. Versions from the earliest available release up to and including 7.7.4 are affected. Any site running any of these plugin versions is vulnerable until the plugin is upgraded to a version that fixes the issue.

The CVSS score of 7.1 categorizes the issue as medium‑high severity, while the EPSS score of less than 1% indicates a low current likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely exploitation path involves an attacker sending a crafted request—such as a URL with malicious query parameters or a crafted form submission—through which the plugin reflects the input back in an HTML response, causing the injected script to run in the victim’s browser.