The Brizy WordPress plugin versions prior to 2.8.19 do not properly sanitize or escape user-supplied featured-image focal-point coordinates submitted through an AJAX action. These coordinates are stored and later output into HTML attributes within the post editor's Featured Image meta box without adequate escaping. This enables users with Contributor role or above to inject malicious scripts that execute when a higher-privileged user opens the post for review, constituting a stored Cross-Site Scripting (CWE-79) vulnerability.

Successful exploitation allows users with Contributor or higher roles to execute arbitrary JavaScript in the browser context of higher-privileged users (e.g., Editors or Administrators) when they view the affected post. This could lead to session hijacking, privilege escalation, or other malicious actions within the WordPress admin interface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor role users from accessing the affected AJAX functionality or disable the Brizy plugin if feasible. Monitor vendor channels for updates and apply the patch once released.