https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 10 Nov 2026 06:31:23 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-115869 <p>The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the &#39;variations&#39; repeater field of Custom Font (tb_cf) posts in versions up to, and including, 7.8.4. This is due to insufficient input sanitization and output escaping on the variations post meta: Themify_Metabox::_save_meta() only passes the value through wp_kses_data() when the field type is &#39;textbox&#39; or &#39;textarea&#39;, so the &#39;repeater&#39; field writes attacker-controlled sub-fields (style, woff/woff2/ttf/svg/eot URLs) to update_post_meta() verbatim, and Themify_Custom_Fonts::render_columns() later echoes those values unescaped inside a &lt;style&gt; block on the Custom Fonts admin listing. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page (specifically, the Custom Fonts admin listing).</p> <p>The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the &#39;variations&#39; repeater field of Custom Font (tb_cf) posts in versions up to, and including, 7.8.4. This is due to insufficient input sanitization and output escaping on the variations post meta: Themify_Metabox::_save_meta() only passes the value through wp_kses_data() when the field type is &#39;textbox&#39; or &#39;textarea&#39;, so the &#39;repeater&#39; field writes attacker-controlled sub-fields (style, woff/woff2/ttf/svg/eot URLs) to update_post_meta() verbatim, and Themify_Custom_Fonts::render_columns() later echoes those values unescaped inside a &lt;style&gt; block on the Custom Fonts admin listing. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page (specifically, the Custom Fonts admin listing).</p> https://db.gcve.eu/vuln/fkie_cve-2026-115869 https://db.gcve.eu/vuln/ghsa-2m93-9jp5-xhh2 <p>The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the &#39;variations&#39; repeater field of Custom Font (tb_cf) posts in versions up to, and including, 7.8.4. This is due to insufficient input sanitization and output escaping on the variations post meta: Themify_Metabox::_save_meta() only passes the value through wp_kses_data() when the field type is &#39;textbox&#39; or &#39;textarea&#39;, so the &#39;repeater&#39; field writes attacker-controlled sub-fields (style, woff/woff2/ttf/svg/eot URLs) to update_post_meta() verbatim, and Themify_Custom_Fonts::render_columns() later echoes those values unescaped inside a &lt;style&gt; block on the Custom Fonts admin listing. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page (specifically, the Custom Fonts admin listing).</p> <p>The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the &#39;variations&#39; repeater field of Custom Font (tb_cf) posts in versions up to, and including, 7.8.4. This is due to insufficient input sanitization and output escaping on the variations post meta: Themify_Metabox::_save_meta() only passes the value through wp_kses_data() when the field type is &#39;textbox&#39; or &#39;textarea&#39;, so the &#39;repeater&#39; field writes attacker-controlled sub-fields (style, woff/woff2/ttf/svg/eot URLs) to update_post_meta() verbatim, and Themify_Custom_Fonts::render_columns() later echoes those values unescaped inside a &lt;style&gt; block on the Custom Fonts admin listing. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page (specifically, the Custom Fonts admin listing).</p> https://db.gcve.eu/vuln/ghsa-2m93-9jp5-xhh2