The Brizy – Page Builder plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Specifically, the plugin fails to adequately sanitize and escape form name values, enabling unauthenticated attackers to inject arbitrary web scripts. These scripts persist in the affected pages and execute in the context of users who visit those pages. The vulnerability affects all versions up to and including 2.4.43. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, scope change, and low impact on confidentiality and integrity.

Successful exploitation allows unauthenticated attackers to inject and execute arbitrary scripts in the context of users visiting the affected pages. This can lead to information disclosure and integrity impacts as indicated by the CVSS vector. There is no indication of availability impact. The vulnerability could be leveraged to perform actions such as session hijacking or defacement depending on the injected payload.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the vulnerable plugin to prevent exploitation. Monitoring for suspicious activity related to injected scripts is advisable. Avoid using affected versions of the plugin in public-facing environments.