What is the CVSS score of CVE-2026-5324?

CVE-2026-5324 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of Brizy Page Builder are affected by CVE-2026-5324?

Brizy Page Builder for WordPress versions 2.8.11 and earlier contain a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious code through form…

How to fix or mitigate CVE-2026-5324?

Within 24 hours: Identify all WordPress installations running Brizy Page Builder and verify current version via Plugins > Installed Plugins in WordPress admin. Within 7 days: Update Brizy Page Builder to version 2.8.12 or later immediately via Dashboard > Plugins > Updates > Update Brizy. Within 30 days: audit WordPress activity logs and admin accounts for unauthorized access; review form submissions received between deployment and patch for suspicious FileUpload field entries; consider rotating administrative credentials as a precaution.

Brizy Page Builder CVE-2026-5324

EUVD-2026-26764 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-05-02 Wordfence

PHP WordPress XSS

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 02, 2026 - 09:30 vuln.today

EUVD ID Assigned

May 02, 2026 - 09:00 euvd

EUVD-2026-26764

Analysis Generated

May 02, 2026 - 09:00 vuln.today

CVE Published

May 02, 2026 - 08:27 nvd

HIGH 7.2

DescriptionCVE.org

The Brizy - Page Builder plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in all versions up to, and including, 2.8.11 This is due to a combination of missing nonce verification for unauthenticated form submissions, insufficient handling of FileUpload fields when no file is uploaded, and the reversal of security encoding via html_entity_decode() followed by unescaped output in the admin view. The submit_form() function skips nonce verification for non-logged-in users (api.php:198). The handleFileTypeFields() function fails to overwrite user-supplied values when no file is attached. While htmlentities() is applied during storage, html_entity_decode() reverses this on display (form-entries.php:79). The form-data.php template outputs FileUpload values directly in href attributes without esc_url(). This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the form Leads page.

AnalysisAI

Unauthenticated attackers can inject stored cross-site scripting payloads into Brizy Page Builder for WordPress (versions ≤2.8.11) via form submission FileUpload fields, which execute when administrators view the form Leads page. The vulnerability chains three implementation flaws: missing nonce verification for anonymous form submissions, inadequate sanitization of FileUpload field values when no file is attached, and reversal of HTML entity encoding via html_entity_decode() before unescaped output in admin views. Publicly available exploit code exists. EPSS data not provided, but the CVSS 7.2 (High) with scope change reflects the privilege escalation from unauthenticated user to admin-context execution. Patch released in version 2.8.12 per WordPress plugin repository changeset 3502206.

Technical ContextAI

This vulnerability affects the Brizy Page Builder WordPress plugin (CPE: cpe:2.3:a:themefusecom:brizy_-_page_builder), a visual page construction tool written in PHP. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation). The attack chain exploits WordPress plugin architecture weaknesses: the submit_form() function in editor/forms/api.php bypasses WordPress nonce validation for unauthenticated requests, the handleFileTypeFields() function fails to sanitize user-controlled FileUpload parameter values when no actual file upload occurs, and the form-entries.php admin view applies html_entity_decode() to stored data before rendering it in form-data.php without esc_url() protection. This creates a double-decode vulnerability where initial htmlentities() encoding during storage is reversed before display, allowing JavaScript injection through href attributes in the administrative Leads interface.

RemediationAI

Upgrade immediately to Brizy Page Builder version 2.8.12 or later, which addresses the vulnerability per WordPress plugin repository changeset 3502206 (https://plugins.trac.wordpress.org/changeset/3502206/brizy/trunk/admin/views/form-data.php and https://plugins.trac.wordpress.org/changeset?old_path=%2Fbrizy/tags/2.8.11&new_path=%2Fbrizy/tags/2.8.12). The patch implements proper output escaping with esc_url() for FileUpload field rendering in admin views. For environments unable to immediately patch, implement these compensating controls with noted trade-offs: (1) Disable Brizy form submission functionality entirely via plugin settings or by removing form blocks from published pages - eliminates attack vector but breaks legitimate form processing; (2) Restrict WordPress admin panel access to trusted IP ranges via web application firewall rules or .htaccess - reduces exposure to admin-viewed XSS but does not prevent payload storage and may block legitimate remote administrators; (3) Implement Content Security Policy headers to prevent inline JavaScript execution in WordPress admin - mitigates XSS impact but requires careful tuning to avoid breaking legitimate admin functionality and provides defense-in-depth rather than vulnerability elimination. None of these workarounds address the root cause. Review form submission logs at /wp-admin/admin.php?page=brizy-forms for suspicious FileUpload field entries containing HTML/JavaScript syntax prior to upgrade.