Themify Builder
Themify Builder has 15 disclosed vulnerabilities in the WordSec catalog, reported between 2021 and 2026; all 15 are fixed as of September 2026. Their average CVSS score is 5.9, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 2 high. 2024 was the busiest year with 6 disclosures.
The most common weakness is Cross-Site Scripting, behind 8 of the records (53%). Other recurring categories include Missing Authorization, Cross-Site Request Forgery (CSRF).
Every one of the 15 issues recorded for Themify Builder has a vendor fix available, so running the current release closes all known holes.
10 independent researchers contributed these findings, most of them (4) reported by Wordfence PRISM. Themify Builder is installed on roughly 5,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.
CVE-2024-56216Themify Builder <= 7.6.3 - Authenticated (Contributor+) Local File Inclusion
Read the full analysisVulnerability Records

Themify Builder
Author
themifyme
The Themify Builder is the most powerful and easy to use page designer and builder for WordPress. Design any layout that you can imagine with its drag and drop interface, and with live preview, you can see everything come together right in front of your eyes. Simply select, drag and drop, and you’ve built beautiful pages – without any coding! The Builder is modular in design and is optimized for better performance resources. It’s also SEO friendly, translatable, and supports multi-site networks. In addition, it comes with its own cache system that reduces the server resources and process processes pages faster. Works on any post type, support HTML input, and play well with all major plugins such as WooCommerce, SEO Yoast, Disqus, MailChimp, Jetpack, WPML, and Contact Form 7. Themify Builder – Overview Builder Features: Responsive across all resolutions. Frontend live preview editing. Compact backend Builder editing. Includes all modules (Text, Video, Accordion, Gallery, Post, Widgetized, Widget, Menu, Button, Slider, Map, Icon, Feature, etc.) Custom styling – Google fonts, background color, padding, margin, and border. Undo/Redo Builder modifications as you edit. Copy/Paste modules, rows, and columns. Import/Export specific modules, rows, and columns from one computer to another. Easily duplicate any module or row. Row and column layout pre-set grids. Rows and columns can be nested in sub rows or columns. Draggable column widths. 60+ predesigned Builder layouts. 60+ animation effects. Responsive Styling. Background – slider, video, parallax scrolling, and gradient. Revisions – allows you to save your Builder layout with unlimited versions. Visibility control where you can set whether a module or row is visible on a specific device. Layout parts – re-usable parts that can be included in the Builder. Custom CSS
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C