Brizy EUVD-2026-104878

Exploitation requires an authenticated WordPress account with at least low-level content-creation privileges (PR:L) on a site using the Brizy plugin 2.8.23, and a second victim user (UI:R) - typically an administrator or editor - who subsequently views or renders the attacker-injected Brizy content, at which point the stored payload fires. Limiting factors: the attacker cannot be fully anonymous (some authenticated role permitting Brizy content editing is needed), the payload only executes when another user opens the affected content, and impact is confined to browser-context script execution (C:L/I:L/A:L) rather than direct server compromise.

This is a moderate, not top-priority, issue. The CVSS 3.1 base score is 6.5 (Medium) with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L: network-reachable and low-complexity, but it requires authenticated access (PR:L) AND victim user interaction (UI:R), which materially limits real-world exploitation. The scope change (S:C) and low C/I/A impacts are consistent with a stored XSS that executes in another user's browser context. No EPSS score, SSVC decision, KEV listing, or POC reference was provided in the input, so exploitation likelihood cannot be quantified from the data given; per the precision rules this is 'no public exploit identified at time of analysis.' The only source is a single Patchstack advisory. Weighing the signals: a stored XSS in a WordPress page-builder plugin that needs an authenticated contributor/author account plus an admin/user viewing the injected content is a realistic but gated threat - typically chained to privilege escalation or admin session hijack - rather than a mass-exploitable unauthenticated RCE. Treat as a standard-cadence patch priority.

An attacker holding a low-privileged authenticated account (e.g., contributor or author) on a WordPress site running Brizy 2.8.23 injects a malicious script payload into a Brizy-managed page or content field. When a higher-privileged user such as an administrator later previews or opens that content in the dashboard, the stored script executes in their browser session, enabling session/cookie theft or actions performed as the admin. No public exploit code was identified at time of analysis.