EUVD-2026-52593
GHSA-3qrh-q76v-gc9c
Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
PR:L because Author-level WordPress access is low privilege; S:C because stored payload executes across all visitors' browser contexts, including administrators outside the attacker's own session.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Brizy WordPress plugin before 2.8.19 does not properly restrict who can modify its site-global design data and does not sanitise part of that data before outputting it, allowing authenticated users with Author-level access and above to store arbitrary JavaScript that is then served unsanitised on the site's front-end pages and executes in the browser of every visitor, including administrators.
AnalysisAI
Stored XSS in the Brizy WordPress plugin (all versions before 2.8.19) allows authenticated Author-level users to inject arbitrary JavaScript into site-global design data, which is then rendered unsanitized on every front-end page of the affected site. Every visitor's browser - including site administrators - silently executes the payload upon page load, enabling session hijacking, credential theft, or full site takeover. A publicly available proof-of-concept exists per WPScan, though no active exploitation is confirmed in CISA KEV; EPSS sits at 0.16% (6th percentile), suggesting opportunistic rather than automated mass exploitation.
Technical ContextAI
The Brizy plugin (CPE: cpe:2.3:a:unknown:brizy:*:*:*:*:*:*:*:*) is a visual page-builder for WordPress that exposes site-global design data as editable configuration. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS): the plugin fails at two distinct control points simultaneously. First, it does not enforce adequate authorization on who may write to site-global design settings - a capability that should be restricted to Editor or Administrator roles but is accessible to Author-level users. Second, it does not apply output encoding or sanitization when rendering those settings into front-end HTML responses. The combination means any Author-controlled string reaches every visitor's browser as raw, executable JavaScript, a classic persistent XSS pattern. The affected plugin surfaces include whatever design-data fields Brizy exposes via its editor interface.
RemediationAI
The primary and only confirmed fix is upgrading the Brizy WordPress plugin to version 2.8.19 or later, which addresses both the insufficient access-control enforcement on design-data writes and the missing output sanitization on front-end rendering. Site administrators can apply the update through the WordPress admin dashboard under Plugins > Installed Plugins, or via WP-CLI. If an immediate upgrade is operationally blocked, the most effective compensating control is to audit and revoke Author-level (and Contributor-level) account access for any user who should not be trusted with site-wide content modifications - this eliminates the authentication prerequisite for exploitation. Monitoring front-end page HTML for unexpected inline script tags can serve as a detection measure. Note that restricting Author accounts has the operational trade-off of preventing legitimate content publishing by those users until the patch is applied. No partial or configuration-based mitigation is documented by the vendor; disabling the Brizy plugin entirely would eliminate the attack surface at the cost of losing page-builder functionality. Advisory reference: https://wpscan.com/vulnerability/e5eecbc1-1e6b-4915-9b42-869219db8ea6/.
The Brizy plugin for WordPress is vulnerable to authorization bypass due to a incorrect capability check on the is_admin
The Unyson WordPress plugin before 2.7.27 does not sanitise and escape a parameter before outputting it back in the page
Stored cross-site scripting in the Brizy WordPress plugin before 2.8.19 allows any authenticated user with Contributor r
The Brizy - Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validatio
The Brizy - Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validatio
The Brizy - Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file extension vali
The Brizy WordPress plugin before 2.4.2 does not sanitise and escape some element content, which could allow users with
The Brizy WordPress plugin before 2.4.2 does not sanitise and escape some element URL, which could allow users with a ro
The Brizy Page Builder plugin <= 2.3.11 for WordPress was vulnerable to stored XSS by lower-privileged users such as a s
The Brizy Page Builder plugin <= 2.3.11 for WordPress allowed authenticated users to upload executable files to a locati
The Brizy - Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form name values in a
The Brizy - Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Link To' field of mu
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today