CVE-2026-95864

Executive Summary

CVE-2026-95864 is a stored cross-site scripting (XSS) vulnerability in the Themify Builder plugin for WordPress, affecting all versions up to and including 7.8.1. The flaw resides in the handling of the css[fonts] parameter, where insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts into pages. Because the required nonce is embedded in plain sight within the front-end page markup for all visitors, the access control reduces to a CSRF token rather than an authentication barrier, making the endpoint fully exploitable by unauthenticated actors.

Technical Analysis

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation, i.e., Cross-Site Scripting) and manifests as a stored (persistent) XSS condition. The attack surface is the Themify Builder plugin's handling of the css[fonts] parameter. In WordPress plugin architectures, parameters structured as css[fonts] indicate an array-style input being processed and subsequently rendered into page output, typically as part of dynamic CSS generation or font configuration.

The root cause is twofold: insufficient input sanitization on the css[fonts] parameter and insufficient output escaping when that value is written back into HTML/CSS contexts. Because the malicious input is stored server-side and later rendered to other users, the script executes in the browser of any visitor who accesses the injected page — the defining characteristic of stored XSS.

A critical aggravating factor is the access control model. The nonce required to reach the vulnerable endpoint is embedded in the front-end page markup visible to all visitors. WordPress nonces are intended as CSRF protections, not authentication barriers. By exposing the nonce in public page HTML, the plugin effectively converts what should be an authenticated operation into an unauthenticated one: any attacker can retrieve the nonce from a public page and replay it against the vulnerable endpoint. The CVSS vector reflects this with PR:N (no privileges required) and UI:N (no user interaction required for the attacker), alongside S:C (scope changed), because the injected script executes in the security context of the affected site's visitors rather than the attacker's origin.

No public PoC, Nuclei template, or exploit code is currently available, and no patch evidence exists from any tracked source. Affected version data is limited to "all versions up to and including 7.8.1." Insufficient technical detail is available to describe specific function names, class names, or exact file paths — the analysis above is derived strictly from the NVD description and CVSS vector.

Exploitation Scenarios

Attack chain inferred from the vulnerability class; no public PoC is available.

1. Reconnaissance / target identification: The attacker identifies a target running WordPress with the Themify Builder plugin. Shodan dorks such as http.html:"themify-builder" or http.html:"/wp-content/plugins/themify-builder/" can enumerate candidate sites. The attacker confirms plugin presence by inspecting front-end markup.

2. Triggering the flaw class: The attacker loads any public front-end page of the target site and extracts the nonce embedded in the page markup. With that nonce, the attacker submits a request to the vulnerable endpoint supplying a crafted value in the css[fonts] parameter. Because the parameter is not sanitized on input, the malicious script content is accepted and stored.

3. Payload / execution: The stored value is later rendered into pages without output escaping. When any visitor loads the affected page, the injected script executes in the visitor's browser within the origin of the vulnerable site — the classic stored XSS execution path. Since this is a payload-class description, the specific JavaScript payload is attacker-defined; no specific code pattern is asserted here.

4. Post-exploitation impact: Executed script can perform actions in the context of the victim's session, including session/token theft, credential harvesting via injected forms, drive-by redirection, or further client-side attacks. Because the injected content is persistent, every visitor to the affected page is a potential victim, giving the attacker a scalable compromise vector. The changed-scope nature of the CVSS vector (S:C) underscores that exploitation affects resources beyond the vulnerable component's own security authority.

Impact Assessment

Successful exploitation yields persistent, unauthorized script execution in the browsing session of any visitor to an injected page. Per the CVSS 3.1 vector (7.2, High), the key subscores are:

• Confidentiality: Low (C:L) — script execution can expose session-relevant data or facilitate credential/session capture, but not wholesale system data.
• Integrity: Low (I:L) — injected content modifies rendered pages for visitors.
• Availability: None (A:N) — no direct denial of service.
• Attack Vector: Network (AV:N), Attack Complexity: Low (AC:L), Privileges Required: None (PR:N), User Interaction: None (UI:N) — trivially reachable and unauthenticated.
• Scope: Changed (S:C) — the impact crosses a security boundary, affecting site visitors rather than the vulnerable component alone.

Blast radius includes all pages into which the tainted parameter value is rendered. Because the plugin is used across many WordPress deployments, any site running Themify Builder <= 7.8.1 that exposes front-end pages with an embedded nonce is potentially affected. Business impact includes reputational damage, visitor compromise, SEO poisoning, malware distribution, and possible regulatory exposure where visitor data is affected. CISA KEV status is NO and EPSS is not yet scored, so no confirmed exploit-in-the-wild is documented — but the unauthenticated, persistent nature raises the risk profile if weaponized.

Detection Guidance

Sigma Rule

title: Themify Builder Stored XSS via css[fonts] Parameter
id: 7f3a1c2e-9586-4b1a-9d64-0000cve202695864
status: experimental
description: Detects HTTP requests targeting the Themify Builder plugin with a crafted css[fonts] parameter consistent with CVE-2026-95864 stored XSS.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-95864
author: valtersit.com
logsource:
  category: webserver
detection:
  selection_method:
    cs-method: 'POST'
  selection_uri:
    cs-uri-query|contains:
      - 'css[fonts]'
  selection_payload:
    cs-uri-query|contains:
      - '<script'
      - 'javascript:'
      - 'onerror='
      - 'onload='
      - '%3Cscript'
  condition: selection_method and selection_uri and selection_payload
falsepositives:
  - Legitimate font configuration containing benign use of encoded angle brackets (rare)
level: high

YARA Rule

rule CVE_2026_95864_Themify_Builder_Stored_XSS
{
    meta:
        description = "Detects stored XSS payloads injected via Themify Builder css[fonts] parameter (CVE-2026-95864)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-95864"
        date = "2026-01-01"
        severity = "high"

    strings:
        $p1 = "css[fonts]" nocase
        $s1 = "<script" nocase
        $s2 = "</script>" nocase
        $s3 = "javascript:" nocase
        $s4 = "onerror=" nocase
        $s5 = "onload=" nocase
        $s6 = "document.cookie" nocase
        $s7 = "eval(" nocase

    condition:
        $p1 and any of ($s*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-95864 Themify Builder Stored XSS via css[fonts] Parameter"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"css[fonts]"; http.uri; content:"<script"; nocase; http.uri; content:"onerror"; nocase; classtype:web-application-attack; reference:cve,2026-95864; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-95864; sid:202695864; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where http.request.method == "POST" and url.query : "*css[fonts]*" and http.request.body.content : ("*<script*" or "*onerror=*" or "*javascript:*") ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=nginx:plus:access
| search method=POST uri_query="*css[fonts]*"
| search uri_query="*<script*" OR uri_query="*onerror=*" OR uri_query="*javascript:*" OR uri_query="*onload=*"
| stats count min(_time) as first_seen max(_time) as last_seen by clientip, uri, uri_query
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,cve-2026-95864,">
  <rule id="202695864" level="12">
    <if_sid>31100,31101,31151,31500</if_sid>
    <match>css[fonts]</match>
    <regex type="pcre2">(?i)(&lt;script|%3Cscript|onerror=|javascript:)</regex>
    <description>CVE-2026-95864: Possible Themify Builder stored XSS exploitation via css[fonts] parameter</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_95864,xss,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Implement virtual patching at the WAF/reverse-proxy layer to block requests containing common XSS payload markers (<script, onerror=, javascript:) in the css[fonts] parameter.
   • If Themify Builder is not actively required, deactivate and remove the plugin.
   • Restrict or monitor access to the vulnerable endpoint; where feasible, deploy a Content-Security-Policy that disallows inline script execution to reduce XSS impact.
   • Monitor web server logs for POST requests targeting css[fonts] with script-like payloads.

2. Patch/upgrade steps:

   • No patched version is currently available; all versions up to and including 7.8.1 are affected.
   • Track the vendor (Themify) and the WordPress plugin repository for an official fix release; apply the update immediately when available.
   • If a fixed version is released, verify the changelog confirms the css[fonts] sanitization/escaping fix before deployment.

3. Long-term hardening:

   • Treat nonces as CSRF tokens only, never as authentication barriers; ensure sensitive endpoints enforce capability/authentication checks server-side.
   • Adopt output escaping (e.g., context-appropriate escaping of style and font configuration values) and input validation across all plugin-supplied dynamic content.
   • Maintain an inventory of WordPress plugins with a vulnerability-monitoring workflow and subscribe to plugin security advisories.
   • Deploy CSP and subresource integrity controls to constrain stored XSS impact.

References

• NVD — CVE-2026-95864: https://nvd.nist.gov/vuln/detail/CVE-2026-95864
• CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
• CVSS v3.1 Specification: https://www.first.org/cvss/v3.1/specification-document
• WordPress Plugin Security best practices: https://developer.wordpress.org/plugins/security/
• CISA Known Exploited Vulnerabilities Catalog (CVE not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat actor campaigns or exploit-in-the-wild evidence are documented for CVE-2026-95864 at the time of this report. No public PoC, Nuclei template, or exploit code is available.