The Brizy – Page Builder plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input in the 'Link To' field across multiple widgets. This allows authenticated users with contributor-level privileges or above to inject arbitrary web scripts into pages. These scripts execute in the context of any user who accesses the compromised page, potentially leading to session hijacking, defacement, or other malicious actions. The vulnerability affects all versions up to and including 2.4.43. No vendor advisory or patch links have been provided, and no known exploits are reported in the wild as of the publication date.

Successful exploitation allows authenticated contributors or higher to inject persistent malicious scripts that execute in the browsers of users viewing the infected pages. This can lead to unauthorized actions such as session hijacking, data theft, or site defacement. The CVSS 3.1 score of 7.4 reflects a high impact on confidentiality, integrity, and availability. Since the attack requires authenticated access with contributor-level privileges, the risk is limited to environments where such user roles exist.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or limiting use of the affected 'Link To' fields in widgets. Monitor for suspicious activity related to page content modifications. Avoid granting contributor or higher privileges to untrusted users.