Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'height_slider' Slider Module Field in all versions up to, and including, 7.7.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-07-12 | 2 | Disclosure2 |
| 2026-07-14 | 1 | Disclosure1 |
Themify Builder plugin for WordPress vulnerable to Stored XSS via 'height_slider' field, affecting all versions up to 7․7․6; CVE-2026-15097, CVSS 6․4 https://ift.tt/2TzPBEk
Post summary
The Themify Builder WordPress plugin (up to 7.7.6) has a Stored XSS flaw (CVE-2026-15097, CVSS 6.4) via the height_slider field; no PoC, exploit, or patch details are available.
🚨*CVE* CVE-2026-15097 The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'height_slider' Slider Module Field in all versions up to, and including, 7.… https://www.cve.org/CVERecord?id=CVE-2026-15097 ----- Traducción: CVE-2026-15097 El … http://infoflow.cloud`
Post summary
The post announces a stored XSS vulnerability in the Themify Builder plugin (CVE-2026-15097), affecting all versions up to 7, with no PoC, exploit, or patch mentioned.
CVE-2026-15097 The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'height_slider' Slider Module Field in all versions up to, and including, 7.… https://www.cve.org/CVERecord?id=CVE-2026-15097
Post summary
CVE‑2026‑15097 reveals a stored XSS vulnerability in the Themify Builder plugin via the 'height_slider' field across all versions up to 7.