CVE-2026-111726

Executive Summary

CVE-2026-111726 is a stored cross-site scripting (XSS) vulnerability in the Themify Builder plugin for WordPress affecting all versions up to and including 7.8.2. The flaw stems from insufficient input sanitization and output escaping of the visible Shortcode attribute, allowing authenticated attackers with contributor-level access or above to inject arbitrary web scripts into pages. The injected scripts execute whenever a user accesses the compromised page, and exploitation is only possible when the slider custom post type is active — a condition automatically satisfied when the plugin is paired with a Themify theme or any other plugin that registers the slider CPT.

Technical Analysis

The vulnerability is a classic stored (persistent) cross-site scripting flaw mapped to CWE-79. At its core, the Themify Builder plugin renders shortcodes that accept a visible attribute. The plugin fails to adequately sanitize user-supplied input into this attribute and fails to escape output when the shortcode is rendered on a page. As a result, HTML or script content supplied to the visible attribute is stored in the WordPress database and echoed back to visitors without proper encoding.

The attack surface is the WordPress content authoring workflow. Because the vulnerable functionality is a shortcode attribute embedded in post/page content, any user who can create or edit content that may contain shortcodes — contributors and above — can attempt injection. The stored nature of the flaw means the payload persists and executes on every page load, elevating risk above reflected XSS.

A critical precondition is noted in the advisory: exploitation requires the slider custom post type to be active. This CPT is registered automatically when Themify Builder is paired with a Themify theme or any other plugin that registers slider. In practice, this means the "only exploitable when" caveat is frequently satisfied in real deployments that use the plugin in its intended ecosystem, lowering the practical barrier to exploitation.

The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N (score 6.4). Notably, the scope is changed (S:C), reflecting that the injected script can affect resources beyond the vulnerable component (e.g., administrator sessions, other users' browsers). Privileges required are low (PR:L — contributor-level), and user interaction is none (UI:N) from the attacker's perspective because the victim triggers execution simply by viewing the page. Confidentiality and integrity impacts are low (C:L/I:L), and there is no availability impact (A:N). No public PoC, Nuclei template, or exploit code exists at time of writing, and the vulnerability is unpatched with no vendor fix evidence.

Exploitation Scenarios

The attack chain is inferred from the vulnerability class (stored XSS) and the details in the NVD description. No public proof-of-concept is available.

1. Reconnaissance / target identification: The attacker identifies WordPress sites running Themify Builder at a version ≤ 7.8.2, for example by enumerating the plugin path or fingerprinting pages that reference themify-builder assets. The attacker confirms the site uses a Themify theme or another component that registers the slider custom post type, which is the precondition for exploitability.

2. Obtaining write access: The attacker requires an authenticated account with contributor-level privileges or higher. This could be obtained through registration flows that grant contributor roles, credential compromise, or another vulnerability. With that access, the attacker can create or edit content containing builder shortcodes.

3. Payload injection: The attacker supplies a crafted value into the visible Shortcode attribute. Because the plugin neither sanitizes this input nor escapes it on output, a script payload embedded in the attribute is persisted to the database and later rendered into the page HTML unsafely.

4. Execution and post-exploitation impact: When any user — including higher-privileged users or site administrators — accesses the injected page, the script executes in their browser under the site's origin. Given the scope-changed rating, this can lead to session hijacking, theft of authentication cookies or tokens, actions performed with the victim's privileges, content defacement, or redirection/credential phishing. Because the payload is stored, execution recurs for every visitor until removed.

No specific function names, endpoints, or parameter identifiers beyond the documented visible attribute and slider CPT are asserted here; the mechanics beyond that are inferred from the stored XSS class.

Impact Assessment

Business impact centers on compromise of user sessions and trust in the affected site. Although individual confidentiality and integrity impacts are rated low, the changed scope means the injection can pivot into administrative sessions and other users' browsers, potentially enabling account takeover of privileged users viewing the infected page. Stored XSS is persistent, so a single successful injection can affect all visitors over an extended period, complicating cleanup and increasing blast radius.

Affected systems are WordPress installations running Themify Builder ≤ 7.8.2, particularly those paired with a Themify theme or any plugin registering the slider custom post type. Because contributor accounts are relatively common on multi-author sites, the low privilege requirement (PR:L) broadens the pool of potential attackers. There is no availability impact (A:N), so service disruption is not a primary concern, but reputational and compliance exposure from session compromise and defacement remains significant. EPSS is not yet scored by FIRST.org, and the CVE is not in CISA KEV; no evidence of active exploitation is currently available.

Detection Guidance

Sigma Rule

title: Suspicious Themify Builder Shortcode Injection via visible Attribute
id: 8f2c1a4e-7b3d-46a1-9c2e-1a2b3c4d5e6f
status: experimental
description: Detects content submissions containing script payloads in shortcode visible attributes targeting Themify Builder
logsource:
  product: wordpress
  service: web
detection:
  selection_request:
    cs-uri-query|contains:
      - 'visible='
  selection_payload:
    cs-uri-query|contains:
      - 'script'
      - 'onerror='
      - 'onload='
      - 'javascript:'
  condition: selection_request and selection_payload
fields:
  - c-ip
  - cs-uri-query
  - cs-user-agent
falsepositives:
  - Legitimate admin content containing the word script in shortcode parameters
level: medium
tags:
  - attack.t1190
  - cve.2026.111726

YARA Rule

rule CVE_2026_111726_Themify_Visible_Shortcode_XSS
{
    meta:
        description = "Detects stored XSS payloads in Themify Builder visible shortcode attribute"
        cve = "CVE-2026-111726"
        author = "Threat Intelligence"
        date = "2025-01-01"
    strings:
        $shortcode = "[themify" nocase
        $visible = /visible\s*=\s*["'][^"']{0,200}(<script|onerror\s*=|onload\s*=|javascript:)/ nocase
        $script = /(<\s*script|onerror\s*=|onload\s*=|javascript:)/ nocase
    condition:
        $shortcode and $visible or ($shortcode and $script)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-111726 Themify Builder visible Shortcode XSS Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"wp-admin"; http.request_body; content:"visible"; nocase; http.request_body; pcre:"/(<script|onerror\s*=|onload\s*=|javascript:)/i"; classtype:web-application-attack; reference:cve,2026-111726; sid:2026111726; rev:1;)

Elastic Detection

sequence by user.name
  [process where event.category == "web" and url.query : "visible*"]
  [any where event.category == "web" and wildcard(url.query, "*visible*<script*", "*visible*onerror*", "*visible*javascript:*")]

Splunk SPL Query

index=web sourcetype=access_combined
| eval q=lower(uri_query)
| where (like(q,"%visible=%") AND (like(q,"%<script%") OR like(q,"%onerror=%") OR like(q,"%onload=%") OR like(q,"%javascript:%")))
| table _time, src_ip, uri, uri_query, user_agent, status
| sort - _time

Wazuh OSSEC Rule

<group name="web,appsec,wordpress,">
  <rule id="2026117" level="10">
    <if_sid>31100,31103</if_sid>
    <url>visible=</url>
    <regex type="pcre2">(?i)(&lt;script|onerror\s*=|onload\s*=|javascript:)</regex>
    <description>CVE-2026-111726: Possible Themify Builder visible shortcode stored XSS injection attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_111726,xss,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations: Because no vendor patch exists, restrict contributor-level account creation and review existing contributor accounts. Enforce least privilege on content-authoring roles. Deploy a Web Application Firewall (WAF) with rules to block script content in query and body parameters, particularly targeting the visible attribute. Scan existing posts and pages for suspicious shortcode content containing script payloads in visible attributes and remove any discovered. Consider disabling or reviewing use of the slider custom post type where not required. Set HttpOnly and Secure flags on session cookies to reduce session-theft impact, and enforce Content Security Policy headers to limit script execution.

2. Patch/upgrade steps: Monitor the Themify vendor channels for an official release addressing this issue above 7.8.2 and apply it as soon as available. Verify patch authenticity against the vendor advisory before deployment.

3. Long-term hardening: Maintain an inventory of WordPress plugins and versions, prioritize vulnerability monitoring for unpatched components, enforce role-based access reviews, implement input validation and output encoding at the application layer where customizations exist, and adopt defense-in-depth controls (CSP, WAF, cookie hardening) to reduce stored XSS impact.

References

• NVD — CVE-2026-111726: https://nvd.nist.gov/vuln/detail/CVE-2026-111726
• MITRE CWE-79 (Improper Neutralization of Input During Web Page Generation / Cross-site Scripting): https://cwe.mitre.org/data/definitions/79.html
• Themify official site/advisory channel: https://themify.me/
• FIRST EPSS (not yet scored for this CVE): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (not listed as of intelligence date): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat actor campaigns or exploit-in-the-wild evidence are currently associated with CVE-2026-111726.