CVE-2024-1164 is a stored cross-site scripting vulnerability in the Brizy – Page Builder WordPress plugin (themefusecom). The issue stems from improper neutralization of input during web page generation, specifically in the contact form widget's error message and redirect URL. Authenticated users with contributor-level or higher privileges can inject arbitrary scripts that execute in the context of other users viewing the compromised pages. This vulnerability affects all versions up to and including 2.4.43. The CVSS 3.1 base score is 6.4, reflecting a medium severity with network attack vector, low attack complexity, and requiring privileges but no user interaction.

Successful exploitation allows an authenticated contributor or higher to inject and execute arbitrary JavaScript in the context of other users' browsers when they access the injected pages. This can lead to information disclosure and integrity impacts limited to the affected web application context. There is no direct availability impact. The vulnerability requires authenticated access at contributor level or above, limiting the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level permissions to trusted users only and consider disabling or limiting use of the contact form widget. Monitor official themefusecom channels for updates and apply patches promptly once released.