What is the CVSS score of CVE-2026-16069?

CVE-2026-16069 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for CVE-2026-16069?

Yes, a public proof-of-concept exploit is available for CVE-2026-16069. Prioritise patching immediately. EPSS: 0.2%.

Is there a patch available for CVE-2026-16069?

Yes, a patch is available for CVE-2026-16069. Update the affected software to the latest version immediately.

Brizy WordPress Plugin CVE-2026-16069

EUVD-2026-52594 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-08-04 WPScan

GHSA-xpm5-253f-8839

WordPress XSS Brizy Unknown

6.8

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

6.8 MEDIUM

AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.7 HIGH

Contributor is PR:L not PR:H; stored XSS executing in admin's session crosses scope boundary (S:C); no direct availability impact on the server.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 04, 2026 - 15:32 vuln.today

Patch available

Aug 04, 2026 - 07:01 EUVD

CVE Published

Aug 04, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 04, 2026 - 06:00 cve.org

MEDIUM 6.8

DescriptionCVE.org

The Brizy WordPress plugin before 2.8.19 does not sanitize or escape featured-image focal-point coordinates submitted through one of its AJAX actions before storing them and later echoing them into HTML attributes in the post editor's Featured Image meta box, allowing users with the Contributor role or above to inject arbitrary web scripts that execute in the session of a higher-privileged user who opens the post for review.

AnalysisAI

Stored cross-site scripting in the Brizy WordPress plugin before 2.8.19 allows any authenticated user with Contributor role or above to plant persistent XSS payloads via unsanitized featured-image focal-point coordinates submitted through an AJAX action. When a higher-privileged user (Editor or Administrator) later opens the affected post for review, the injected script executes silently in their browser session, enabling session hijacking or unauthorized administrative actions. A publicly available exploit exists per WPScan; the vendor has released a fix in version 2.8.19.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation) describes this root cause: user-supplied data flows from an AJAX endpoint into persistent storage and is later rendered into HTML attributes without output encoding or input sanitization. The affected component is the Brizy page builder plugin for WordPress (CPE: cpe:2.3:a:unknown:brizy:*:*:*:*:*:*:*:*), specifically the AJAX handler responsible for processing focal-point coordinate metadata for featured images. The payload is stored in the WordPress database and re-rendered inside HTML attribute context within the post editor's Featured Image meta box - a privileged editorial interface - meaning the injection surface is only visible to higher-privilege roles, which delays detection while maximizing impact. The attack abuses the trust WordPress editors inherently place in content authored by lower-privilege contributors.

RemediationAI

Update the Brizy plugin to version 2.8.19 or later, which includes the vendor-released fix per the WPScan advisory (https://wpscan.com/vulnerability/3fce478e-e240-46f4-b4a5-682eec11c7ad/) and NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-16069). If immediate patching is not possible, restrict Contributor-level account creation and audit existing Contributor accounts for trustworthiness, as they represent the attacker's required access level. As a compensating control, consider disabling the Brizy plugin temporarily and substituting a different featured-image workflow - the trade-off is loss of Brizy page-builder functionality. Site administrators should also review recent posts authored by Contributor-level users for unexpected script tags or encoded payloads in featured-image metadata. WordPress security plugins with XSS output-sanitization filters may provide partial mitigation but are not a substitute for patching.