UiChemy – Convert Figma, Prompts and AI Builds to Elementor, Gutenberg and Bricks
UiChemy – Convert Figma, Prompts and AI Builds to Elementor, Gutenberg and Bricks has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2025 and 2026; all 2 are fixed as of October 2026. Their average CVSS score is 5.3, and the most serious one scores 6.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (50%). Other recurring categories include Missing Authorization.
Every one of the 2 issues recorded for UiChemy – Convert Figma, Prompts and AI Builds to Elementor, Gutenberg and Bricks has a vendor fix available, so running the current release closes all known holes.
2 independent researchers contributed these findings, one record each. UiChemy – Convert Figma, Prompts and AI Builds to Elementor, Gutenberg and Bricks is installed on roughly 8,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
CVE-2025-69362UiChemy <= 4.4.2 - Authenticated (Author+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records

UiChemy – Convert Figma, Prompts and AI Builds to Elementor, Gutenberg and Bricks
Author
POSIMYTH
Build Anywhere. Own It In WordPress. Start from a prompt, a client brief, a Figma design, or an AI build. UiChemy turns it into native, editable WordPress you own, in the builder you already use. Building For WordPress Should Not Mean Building Twice Three things go wrong on the way from an idea to a live WordPress site, and each one means doing the same work twice. The layout gets rebuilt by hand. Whatever you designed or generated is assembled a second time once it reaches WordPress. Same structure, same spacing, same decisions, made again on every project. The output cannot be edited. Many tools return an iframe, a locked template, or markup sealed inside a closed format. It renders correctly and it cannot be maintained, so every small change comes back to you instead of going to whoever owns the site. The page does not live on your site. When content is rendered from somewhere else, it is not in your database, not in your backups, and not something you can hand to another developer or move to different hosting. What UiChemy Does Instead UiChemy converts your design into WordPress using a single UiChemy Composer widget, an AI first visual editor that holds real HTML, CSS and JavaScript. You add that one widget, once. Every section you build from then on is genuine code stored in your own database, on your own hosting, rendered natively inside your builder. Plain web standards any developer can read, with a visual editor over the top so you can change every line of it. Not a screenshot of a design. Not an embed. Not a format only we can open. The marquee still slides. The accordion still opens. Nothing stops working because a subscription lapsed. Rated 4.9 out of 5 and used by 90,000+ designers, freelancers and agencies. Website | Pricing | Documentation | Roadmap | Facebook Community | Official Community | Premium Support | Video Tutorials See UiChemy in Action One platform, four ways in. Use whichever one matches where your work already starts. 1. Figma to WordPress Figma to WordPress converts any Figma design into editable WordPress. No rebuild, no lock-in. UiChemy reads your frames, layers and Auto Layout the way you built them, then rebuilds the page inside your builder as a UiChemy Composer section holding real HTML, CSS and JavaScript. Your structure carries across and every part of it stays editable. How It Works Design In Figma : Build in Auto Layout, following the Design Guidelines Run The Figma Plugin : Pick your frame and export it straight from Figma Connect Your Site : Link your WordPress domain once, then reuse it on every project Hit Import : The page opens in your builder ready to edit, not ready to rebuild What You Get Global Style Sync : Figma colours and type become reusable classes in your builder’s global settings, so a brand tweak is one change instead of forty Responsive Output Manager : Set breakpoint rules once and stop hand-fixing every mobile view after import Precise Layer Mapping : Tag a layer to the exact element you want, so the output matches your intent Modern Image Handling : WebP, AVIF and SVG files import with the page Bulk And Copy Paste Import : Push a whole site in one run, or paste a single section with its media attached Classic Mode And AI Express Mode Classic Mode is the precision path. Tag layers to specific elements before exporting for output you can predict to the pixel. AI Express Mode is the finishing path. No tagging. It reads every layer and applies motion, hover states, responsive breakpoints, global colours and type, then builds your header and footer during the conversion. It runs on Elementor, and Gutenberg and Bricks use Classic Mode. Get the Figma plugin for your builder: Figma to Elementor, Figma to Gutenberg, or Figma to Bricks. 2. AI Website Creator AI Website Creator turns a text prompt or a client brief into a full WordPress site you own. A client says yes on a call and wants to see something by Friday. No design file, no budget approved for one yet, and a week of discovery in between. This closes that gap. How It Works Brief to Sitemap to Design to Export. You write the brief : A paragraph about the business, or a guided six-step brief. Paste a reference URL and it pulls in visual and tonal cues. UiChemy generates the sitemap : Review the pages and sections it proposes, then add, rename, reorder or delete anything before a single pixel is designed. UiChemy designs every page : Each one renders as a real design you can restyle, swapping palettes, fonts, layout variants and imagery. You export to WordPress : The finished site lands as editable pages. What You Get Design Variants : Build two or three complete directions from the same brief, so a client call becomes a choice between real options instead of a debate about one mockup Non Destructive Export : Exporting creates new pages and never overwrites what is already live, so you can run it against a real site Re Export Anytime : Change the design later and push it again. This is a round trip, not a one way dump Safe Restructuring : Reordering the sitemap keeps the design work you already did on untouched sections Multi Builder Output : Send the same project to more than one builder independently, so the decision stays reversible 1,000+ Google Fonts : Enough range to match a brand without dropping to code 3. AI to WordPress AI to WordPress moves any AI build into real, editable WordPress. Keep the design, lose the lock-in. You built something in Claude, Cursor or Codex and it looks right. Getting it into WordPress normally means copying output, pasting it somewhere, and fixing what broke in transit. Worse, what you paste usually lands as markup nobody can edit afterwards. UiChemy runs a Model Context Protocol (MCP) server, so your AI tool writes into WordPress directly. It builds sections, runs conversions and edits pages on your site, and what arrives is real code in your builder. What You Can Move Into WordPress: Claude to WordPress, Lovable to WordPress, Codex to WordPress, V0 to WordPress, Cursor to WordPress, Google Stitch to WordPress, HTML to WordPress, Wix to WordPress, Clone Site to WordPress. How It Works Generate Your Connection : The plugin issues a scoped Application Password Pick Your AI Tool : Claude Desktop, Cursor, Codex, Antigravity or another MCP client Add The MCP Config : Paste the generated block into that tool’s config file Restart And Build : Ask for a section and watch it appear on the site What You Get No Context Switching : Build and revise pages from the editor you already have open, so the browser is where you check the result, not where you do the work Editable Output : Sections arrive as real code in your builder, so the next person to touch the page does not need your AI tool Custom Post Types And Fields : Set up post types and fields through UiChemy Custom Fields, ACF or JetEngine, which covers the scaffolding most client builds start with Agency Repeatability : One prompt pattern produces the same section across five client sites 4. UiChemy Composer UiChemy Composer is an AI first visual editor that writes real HTML, CSS and JavaScript, right inside your builder. Every other builder hands you a widget for each idea, and the one you need always does almost what you want. Composer works the other way round. You add one widget, once, and every section from then on is genuine code stored in your own database. One Editor, Two Modes Design Mode is for whoever owns the content. Text, images, links, colours and spacing, edited on the real page with layers and history. No code on screen, which is why a site is safe to hand to a client. Developer Mode is for whoever owns the code. The class editor, layers panel, global variables, and the code for this section, this page and the whole site. Build With Your Own AI Bring Your Own AI : Connect the subscription you already pay for through the CLI, or drop in your own key. OpenAI, Anthropic, Google, Claude CLI, Codex, Gemini and OpenCode Chat In The Editor : Prompt a new layout or change an existing one, with the full page and site already in context 3 Skills, 100+ Actions : The agent reaches your whole site through one site-wide MCP gateway Or No AI At All : Both modes work by hand if you would rather write it yourself What You Get A Real Class System : Style by class as you would in any front-end project, with global colours and variables you define once Import A Brand, Export It Again : Move a design system between projects instead of rebuilding it per client Dynamic Data : Every WordPress field plus UiChemy Custom Fields, ACF, JetEngine and Metabox, with a visual query builder, loop builder, theme builder and full WooCommerce Forms : Describe the form and it gets built, any element can become a field, submissions collected and spam proof by default Agency Handover : Role Manager, front end only handover, White Label, and one dashboard for every site Code Split Three Ways : Site, page and section styles load separately, so only the code a page uses is served. POSIMYTH measures 90+ on Google PageSpeed in its own testing Why Teams Move to UiChemy Ship In Hours, Not Weeks : The rebuild step disappears, so the gap between an approved idea and a live page is an afternoon rather than a sprint One Tool Instead Of Five : Design conversion, AI site generation, an in-builder code editor and an AI bridge live in the same plugin and the same account White Label And Client Editable : Hand over a site with your branding removed and content fields your client can safely change, without them touching the layout Any Builder, Any Starting Point : Elementor, Gutenberg and Bricks, from a prompt, a brief, a Figma file or an AI build, with the decision reversible later You Keep The Site : Everything lives in your own WordPress install, so a published page keeps serving visitors whatever happens to your plan 🔍 Our Other Products 🥇 The Plus Addons for Elementor – 120+ Elementor Widgets, Free Elementor Theme Builder & Templates 🥇 Nexter Blocks – 90+ Gutenberg Blocks, AI Website Builder, Popup Builder, Mega Menu, Form Builder & 1000+ Templates 🥇 Nexter Extension – 50+ Site Tools: Security, SMTP, Image Optimizer (WebP/AVIF), Theme Builder, Code Snippets, Performance 🥇 NexterWP Theme – Ultra-light, FSE-ready starter theme. Zero jQuery 🥇 WDesignKit – 1000+ Templates, Cloud Block Storage, Gutenberg & Elementor Builder External Services This plugin connects to the following external services: UiChemy Cloud API : When you export a design from Figma, UiChemy communicates with its cloud API to process and convert your Figma design data into page builder compatible format. Design structure data (frames, layers, styles) is sent during export. No personal data is transmitted. Privacy Policy | Terms of Use Figma API : UiChemy’s Figma plugin reads your design data from Figma to generate the export. This requires the Figma plugin to access your currently open Figma file. Figma Privacy Policy | Figma Terms jsDelivr CDN : The composer’s “Add library” catalog offers a curated list of popular open-source JavaScript and CSS libraries. When you choose one, UiChemy adds a pinned cdn.jsdelivr.net URL to that widget’s assets, so visitors to the published page load the file from jsDelivr. Nothing is requested until you add a library, and you can remove or edit the URL at any time. No data about you or your visitors is sent by UiChemy to jsDelivr. jsDelivr Privacy Policy | jsDelivr Terms Google Fonts : The same “Add library” catalog offers a list of Google Fonts. Choosing one adds a fonts.googleapis.com stylesheet URL to that widget’s assets, so visitors to the published page load the font from Google. Nothing is requested until you add a font, and you can remove the URL at any time. Google Privacy Policy | Google Terms
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C