The Brizy – Page Builder plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. This flaw exists in the handling of Custom Attributes for blocks, allowing authenticated users with contributor or higher privileges to inject arbitrary JavaScript code. The injected scripts execute in the context of any user who views the compromised page. This vulnerability affects all versions up to and including 2.4.43. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, required privileges at the contributor level, no user interaction, and impacts on confidentiality and integrity but not availability.

Successful exploitation allows an authenticated contributor or higher user to inject persistent malicious scripts into pages, which execute in the browsers of users who visit those pages. This can lead to unauthorized actions performed on behalf of users, data theft, or session hijacking. The impact affects confidentiality and integrity but does not affect availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level permissions to trusted users only and consider disabling the use of Custom Attributes in the plugin if possible. Monitor for updates from themefusecom regarding patches or official mitigations.