Themify Builder Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in the Themify Builder plugin for WordPress, affecting all versions through 7.6.5. The issue arises from the use of add_query_arg without proper escaping, allowing unauthenticated attackers to inject arbitrary web scripts into pages. These scripts could execute if a user is tricked into clicking a link.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Remediation

Users can update to Themify Builder version 7.6.6 or a newer patched version to address this vulnerability.