CVE-2026-16068: CWE-79 Cross-Site Scripting (XSS) in Brizy
The Brizy WordPress plugin before 2.8.19 does not properly restrict who can modify its site-global design data and does not sanitise part of that data before outputting it, allowing authenticated users with Author-level access and above to store arbitrary JavaScript that is then served unsanitised on the site's front-end pages and executes in the browser of every visitor, including administrators.
AI Analysis
Technical Summary
The Brizy WordPress plugin versions prior to 2.8.19 do not properly restrict modification permissions for site-global design data and fail to sanitize parts of this data before rendering it on the front end. This allows authenticated users with Author-level or higher privileges to store arbitrary JavaScript code that executes in the context of any visitor's browser, constituting a stored Cross-Site Scripting (CWE-79) vulnerability.
Potential Impact
An attacker with Author-level access or above can inject malicious JavaScript that executes in the browsers of all site visitors, potentially leading to session hijacking, privilege escalation, or other malicious actions executed in the context of the affected site. This affects all users visiting the site, including administrators.
Mitigation Recommendations
No official fix or patch is currently confirmed. Users should upgrade to version 2.8.19 or later once available, as the vulnerability affects versions before 2.8.19. Until a patch is released, restrict Author-level and higher user permissions to trusted individuals only and monitor for suspicious activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
CVE-2026-16068: CWE-79 Cross-Site Scripting (XSS) in Brizy
Description
The Brizy WordPress plugin before 2.8.19 does not properly restrict who can modify its site-global design data and does not sanitise part of that data before outputting it, allowing authenticated users with Author-level access and above to store arbitrary JavaScript that is then served unsanitised on the site's front-end pages and executes in the browser of every visitor, including administrators.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Brizy WordPress plugin versions prior to 2.8.19 do not properly restrict modification permissions for site-global design data and fail to sanitize parts of this data before rendering it on the front end. This allows authenticated users with Author-level or higher privileges to store arbitrary JavaScript code that executes in the context of any visitor's browser, constituting a stored Cross-Site Scripting (CWE-79) vulnerability.
Potential Impact
An attacker with Author-level access or above can inject malicious JavaScript that executes in the browsers of all site visitors, potentially leading to session hijacking, privilege escalation, or other malicious actions executed in the context of the affected site. This affects all users visiting the site, including administrators.
Mitigation Recommendations
No official fix or patch is currently confirmed. Users should upgrade to version 2.8.19 or later once available, as the vulnerability affects versions before 2.8.19. Until a patch is released, restrict Author-level and higher user permissions to trusted individuals only and monitor for suspicious activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-07-17T13:18:01.131Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a7187d0bf32cb7a34e19ad6
Added to database: 08/04/2026, 06:33:52 UTC
Last enriched: 08/04/2026, 06:54:09 UTC
Last updated: 08/04/2026, 12:56:01 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.