Brizy Page Builder CVE-2026-14882

Exploitation requires an authenticated WordPress account with contributor-level privileges or above on a site running Brizy - Page Builder ≤2.8.18; the attacker injects the payload through the 'brizy-compiled-sections' parameter when creating/editing page content. The stored script only fires when another user (potentially a higher-privileged editor or administrator) subsequently views the injected page, so successful impact depends on victim page access. Limiting factors: no anonymous/unauthenticated path (contributor account mandatory), and impact is confined to in-browser script execution rather than direct server compromise. Applies to default configurations - no special feature toggle is required beyond normal content-editing capability.

This is a moderate-severity stored XSS (CVSS 6.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) that should be treated as a routine patch-management priority rather than an emergency. The network vector (AV:N) and low complexity (AC:L) favor the attacker, but exploitation is gated by PR:L - a pre-existing authenticated account at contributor level or above - which is the single most important limiting factor and the reason this is not a critical remote-unauthenticated issue. The scope change (S:C) is the element that elevates real impact: a low-privileged contributor can plant script that executes in the browser of higher-privileged users (e.g. editors/admins) who view the page, enabling potential session or privilege escalation, though only Low confidentiality/integrity impact (C:L/I:L, A:N) is rated. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or mass scanning - consistent with a contributor-gated flaw that is not trivially mass-exploitable. No key signals conflict: the CVSS network vector and the description's 'authenticated contributor' requirement are aligned.

An attacker who holds or obtains a contributor-level WordPress account (e.g. via self-registration, a compromised low-privilege user, or a multi-author site) edits a page through Brizy and submits a malicious script through the 'brizy-compiled-sections' parameter. Because the input is neither sanitized nor escaped, the payload is stored and later runs in the browser of any user who views that page - including administrators - potentially hijacking their session. No public exploit code was identified at the time of analysis.