CVE-2026-5324 is a stored cross-site scripting vulnerability in the Brizy – Page Builder WordPress plugin (up to version 2.8.11). It results from a combination of missing nonce checks for unauthenticated users submitting forms, failure to sanitize file upload fields when no file is attached, and the use of html_entity_decode() which reverses prior encoding before outputting data without proper escaping. Specifically, the submit_form() function skips nonce verification for non-logged-in users, handleFileTypeFields() does not overwrite user input when no file is uploaded, and form-data.php outputs file upload values directly in href attributes without esc_url(). This allows unauthenticated attackers to inject arbitrary scripts that execute in the administrator's browser when viewing the form Leads page.

An unauthenticated attacker can inject persistent malicious scripts into form submissions that execute in the context of an administrator's browser. This can lead to information disclosure or session hijacking affecting the administrator. The vulnerability does not impact availability but compromises confidentiality and integrity of the administrator's session and data. The CVSS 3.1 score of 7.2 reflects high severity with network attack vector, no privileges required, no user interaction needed, and scope change.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently available. Until a patch is released, administrators should avoid viewing form Leads pages or restrict access to trusted users only. Monitoring vendor communications for updates is recommended.