Brizy Page Builder CVE-2026-2585

Requires an authenticated account with Contributor-level role or higher on the target WordPress site running Brizy - Page Builder version 2.8.14 or earlier; the attacker injects the payload via the 'rootAttributes' parameter during page editing. Execution is deferred and conditional: the malicious script only fires when a user (typically a reviewing editor or administrator) subsequently accesses or previews the injected page, so no direct user interaction is needed by the attacker but a victim page view is required for impact. The Contributor authentication gate is the primary limiting factor - sites that do not expose Contributor (or higher) accounts to untrusted parties face little practical exposure.

This is a moderate-severity, authenticated stored XSS whose real-world risk is meaningfully constrained by its privilege requirement. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N = 6.4) is internally consistent with the description: network-reachable, low complexity, but requiring Contributor-level (PR:L) authenticated access, with scope-change (S:C) reflecting script execution in a victim's browser context and limited (C:L/I:L) impact. No EPSS score, no CISA KEV listing, and no public exploit code are present in the supplied intelligence, so this is 'no public exploit identified at time of analysis' rather than an actively-exploited priority. The dominant limiting factor is the trust boundary: an attacker needs a valid Contributor account, which on most sites is a semi-trusted role, making this primarily a privilege-escalation lever (Contributor → executing JS in an Editor/Admin browser when they preview or view the injected page) rather than a mass-exploitable unauthenticated flaw. Treat as a routine 'patch on next maintenance cycle' item unless the site grants Contributor accounts to untrusted users, where it rises to a genuine account-takeover / admin-session-theft concern. No conflicting signals: CVSS network vector matches the WordPress admin-over-HTTP delivery described.

An attacker holding a Contributor account on a Brizy-powered WordPress site edits a page and injects a malicious script payload through the 'rootAttributes' parameter, which the plugin stores without adequate sanitization or output escaping. When a higher-privileged user (editor or administrator) later previews or opens that page in wp-admin, the script executes in their authenticated browser session, enabling session/cookie theft, admin-action forgery, or persistence. No public proof-of-concept is referenced in the supplied data.