Skip to content
PluginCanary

Themify Builder

by themifyme · 6,000+ active installs · Checked 3 Nov 2026
Healthy

Healthy: maintained, last release 29 Oct 2026, 22 releases in 24 months, no unpatched vulnerabilities.

86/ 100 Canary Score
Sub-scores for Themify Builder
Ownership100
Maintenance100
Security60
SupportNo data
ReputationNo data

How the score works

Quick answers

Is Themify Builder still maintained?
Yes. Last release 29 Oct 2026, 22 releases in the last 24 months. 29 Oct 2026 · wordpress.org
Who owns Themify Builder, and has it changed hands?
No change recorded. Main committer themifyme since Dec 2018. 3 Nov 2026 · SVN log
Was Themify Builder removed from wordpress.org?
No. Listed on wordpress.org as of 3 Nov 2026. 3 Nov 2026 · wordpress.org
Is Themify Builder safe?
19 known vulnerabilities, all fixed (latest in 7.8.5). Not on the exploited list. 30 Oct 2026 · Wordfence Intelligence
Is the latest Themify Builder update safe to install?
No ownership change before 7.8.5. No one-star spike after it. 29 Oct 2026 · Release history

Active signals

Facts we detected, with links to the source.

No open risk signals. Signals appear here when we detect an ownership change, closure, vulnerability or decline.

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
plugin-master11 Dec 2018 to 11 Dec 2018, 1 commits
themifyme11 Dec 2018 to 29 Oct 2026, 922 commits

2 committers recorded. No ownership change since 2018.

Maintenance

Last release
6 days ago
Releases, 24 months
22
Tested up to
7.1 current
Requires PHP
7.4 supported 8.2+
Releases per quarter
Releases per quarter for Themify Builder
Q1 20240
Q2 20240
Q3 20243
Q4 20244
Q1 20251
Q2 20250
Q3 20253
Q4 20250
Q1 20260
Q2 20265
Q3 20267
Q4 20263

Last release 29 Oct 2026. Tested with WordPress 7.1 (current).

Reputation

Last 90 days: no reviews. Lifetime: 3.9.

Rating distribution
5 star16
4 star0
3 star2
2 star2
1 star4

Security record

14 vulnerabilities in 24 months (19 on record), all patched (latest fixed in 7.8.5).

Show 19 patched vulnerabilities
PublishedIssueCVSSAffectedFixed inDays to patch
30 Oct 2026Themify Builder <= 7.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'variations' Repeater Field6.4<= 7.8.47.8.5Patched before disclosure
16 Oct 2026Themify Builder <= 7.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'visible' Shortcode Attribute6.4<= 7.8.27.8.3Patched before disclosure
28 Sep 2026Themify Builder <= 7.8.1 - Authenticated (Contributor+) PHP Object Injection7.5<= 7.8.17.8.2Patched before disclosure
24 Sep 2026Themify Builder <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via 'css[fonts]' Parameter7.2<= 7.8.17.8.2Patched before disclosure
21 Aug 2026Themify Builder <= 7.8.0 - Missing Authorization to Unauthenticated Arbitrary Builder Data Modification via 'tb_update_old_data' AJAX Action5.3<= 7.8.07.8.1Patched before disclosure
15 Jul 2026Themify Builder <= 7.7.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Stylesheet Write/Delete via tb_generate_on_fly AJAX Action4.3<= 7.7.77.7.8Patched before disclosure
10 Jul 2026Themify Builder <= 7.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map Module 'b_width_map' Field6.4<= 7.7.67.7.7Patched before disclosure
10 Jul 2026Themify Builder <= 7.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'height_slider' Slider Module Field6.4<= 7.7.67.7.7Patched before disclosure
7 Jul 2026Themify Builder <= 7.7.4 - Unauthenticated Stored Cross-Site Scripting7.2<= 7.7.47.7.5Patched before disclosure
23 Sep 2025Themify Builder <= 7.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 7.6.97.7.01
20 Aug 2025Themify Builder <= 7.6.7 - Missing Authorization4.3<= 7.6.77.6.8Patched before disclosure
21 Jan 2025Themify Builder <= 7.6.5 - Reflected Cross-Site Scripting6.1<= 7.6.57.6.6Patched before disclosure
19 Dec 2024Themify Builder <= 7.6.3 - Authenticated (Contributor+) Local File Inclusion8.8<= 7.6.37.6.5Patched before disclosure
13 Nov 2024Themify Builder <= 7.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 7.6.57.6.627
4 Oct 2024Themify Builder <= 7.6.2 - Reflected Cross-Site Scripting6.1<= 7.6.27.6.3Patched before disclosure
21 Aug 2024Themify Builder <= 7.6.1 - Missing Authorization to Authenticated (Contributor+) Post Duplication4.3<= 7.6.17.6.2Patched before disclosure
23 May 2024Themify Builder <= 7.5.7 - Open Redirect via 'tb_redirect_fail'6.1<= 7.5.77.5.8n/a
5 Feb 2024Themify Builder <= 7.0.5 - Cross-Site Request Forgery4.3<= 7.0.57.0.6n/a
4 Oct 2021Themify Builder <= 5.3.1 - Reflected Cross-Site Scripting6.1<= 5.3.15.3.2n/a

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Support

Support history appears after our first snapshots of the forum counts.

Momentum

6,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for Themify Builder
4 May 2026189
11 May 2026542
18 May 20264,571
25 May 2026950
1 Jun 20264,496
8 Jun 2026691
15 Jun 20264,289
22 Jun 2026590
29 Jun 2026494
6 Jul 20268,411
13 Jul 20265,371
20 Jul 2026656
27 Jul 2026623
3 Aug 20264,818
10 Aug 20264,498
17 Aug 20265,173
24 Aug 20261,020
31 Aug 2026706
7 Sep 2026628
14 Sep 2026663
21 Sep 2026762
28 Sep 2026721
5 Oct 2026504
12 Oct 20264,521
19 Oct 20264,940
26 Oct 20265,171
2 Nov 2026238

Weekly downloads over the last 4 weeks are 52% above the 27-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.

No healthier plugin in the same category yet.

Facts

Version7.8.5
Authorthemifyme
Added11 Dec 2018
Last updated29 Oct 2026
Active installs6,000+
Requires WordPress5.2
Tested up to7.1.4
Requires PHP7.4
CategoryDesign & Themes > Page Builders & Visual Editors
Tagsbuilder, page builder, drag-and-drop, visual builder, drag and drop builder

Other plugins by this author: Conditional Menus, Themify Portfolio Post, Themify - WooCommerce Product Filter, Themify Popup, Themify Shortcodes, Themify Icons, Themify Event Post, Themify Audio Dock, Themify Store Locator

Questions

Is Themify Builder still maintained?

Yes. Last release 29 Oct 2026, 22 releases in the last 24 months.

Who owns Themify Builder, and has it changed hands?

No change recorded. Main committer themifyme since Dec 2018.

Was Themify Builder removed from wordpress.org?

No. Listed on wordpress.org as of 3 Nov 2026.

Is Themify Builder safe?

19 known vulnerabilities, all fixed (latest in 7.8.5). Not on the exploited list.

Is the latest Themify Builder update safe to install?

No ownership change before 7.8.5. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 3 Nov 2026.Report a data issue