EUVD-2026-37873
GHSA-m7fg-j95w-crhw
Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
PR:H confirmed by admin/editor requirement; S:C reflects browser context crossing; limited C/I/A due to constrained script scope.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
1DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bricksable for Bricks Builder allows Stored XSS.
This issue affects Bricksable for Bricks Builder: from n/a through 1.6.83.
AnalysisAI
Stored Cross-Site Scripting in the Bricksable for Bricks Builder WordPress plugin (versions through 1.6.83) allows a high-privileged attacker to inject persistent malicious scripts into page builder elements, which then execute in victims' browsers when affected pages are loaded. The CVSS scope change (S:C) confirms the injected payload crosses into the victim's browser security context, enabling session hijacking, credential theft, or unauthorized actions on behalf of the viewing user. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the stored nature of this XSS increases persistence risk relative to reflected variants.
Technical ContextAI
Bricksable for Bricks Builder is a WordPress plugin (CPE: cpe:2.3:a:bricksable:bricksable_for_bricks_builder) that extends the Bricks Builder visual page editor with additional UI elements and widgets. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-supplied input within one or more Bricksable elements is insufficiently sanitized or escaped before being rendered as HTML in the page output. Because the payload is stored server-side (in the WordPress post/option database), it executes for every subsequent visitor who loads the affected page - not just once. The S:C metric in the CVSS vector confirms the injected script runs outside the application's own security context, i.e., in the victim's browser session, giving the attacker access to cookies, local storage, and the DOM of the viewed page.
RemediationAI
The primary remediation is to update the Bricksable for Bricks Builder plugin to a version beyond 1.6.83. A released patched version is referenced by the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/bricksable/vulnerability/wordpress-bricksable-for-bricks-builder-plugin-1-6-83-cross-site-scripting-xss-vulnerability), but an exact fixed version number is not independently confirmed from the available source data - verify the latest release in the WordPress plugin repository or vendor changelog before deploying. As a compensating control where immediate patching is not possible, restrict plugin editing and page-builder access strictly to trusted administrator accounts, reducing the pool of users who could introduce a malicious payload. Additionally, deploying a Web Application Firewall (WAF) rule targeting stored XSS patterns on Bricksable element fields can reduce injection risk, though WAF bypass is possible and should not replace patching. Audit existing Bricksable-powered pages for unexpected script tags if compromise is suspected.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today