The Brizy WordPress plugin versions prior to 2.8.19 do not properly restrict modification of site-global design data and fail to sanitize parts of this data before output. Authenticated users with Author-level permissions or above can exploit this flaw to store arbitrary JavaScript code. This code executes in the context of the site's front-end pages, affecting all visitors and potentially compromising their browsers.

This vulnerability allows authenticated users with Author-level access or higher to perform stored cross-site scripting attacks. The injected JavaScript executes in the browsers of all site visitors, including administrators, potentially leading to session hijacking, privilege escalation, or other client-side attacks. However, the CVSS score of 3.5 and low severity rating indicate limited impact, likely due to the requirement for authenticated user privileges and user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Author-level access and above to trusted users only and monitor for suspicious activity related to site-global design data modifications.