Back to the CVE list

CVE-2026-109989

Themify Popup <= 1.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via 'popup_width_unit' Parameter

CVSS score

6.4

EPSS probability

%0.2

Risk score

0.0

Published

2 d ago

Overview Public Exploits (0)Newsroom Vulnerability Timeline

Related Security News

Articles and analysis bulletins in which the press and security publications have covered this vulnerability:

No verified news item has been matched to this CVE yet.

Similar Vulnerabilities

8.8

CVE-2026-96831WordPress Themify Builder plugin <= 7.8.1 - PHP Object Injection vulnerability

Vendorthemifyme ProductThemify Builder

Patch status unknownEPSS %019 d ago

5.3

CVE-2026-75027Themify Builder <= 7.8.0 - Missing Authorization to Unauthenticated Arbitrary Builder Data Modification via 'tb_update_old_data' AJAX Action

Vendorthemifyme ProductThemify Builder

Patch status unknownEPSS %11 mo ago

6.1

CVE-2026-78172Themify – WooCommerce Product Filter <= 1.5.5 - Reflected Cross-Site Scripting

Vendorthemifyme ProductThemify – WooCommerce Product Filter

Patch status unknownEPSS %01 mo ago

7.2

CVE-2026-95864Themify Builder <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via 'css[fonts]' Parameter

Vendorthemifyme ProductThemify Builder

Patch status unknownEPSS %024 d ago

6.4

CVE-2026-111726Themify Builder <= 7.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'visible' Shortcode Attribute

Vendorthemifyme ProductThemify Builder

Patch status unknownEPSS %02 d ago

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free key Documentation

curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-109989"