CVE-2026-5324
Brizy Page Builder WordPress Plugin Unauthenticated Stored XSS
Publication date: 2026-05-02
Last updated on: 2026-05-05
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| brizy | page_builder | to 2.8.11 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The Brizy – Page Builder plugin for WordPress has a vulnerability known as Unauthenticated Stored Cross-Site Scripting (XSS) in all versions up to and including 2.8.11.
This vulnerability arises because the plugin does not verify nonces for unauthenticated form submissions, mishandles FileUpload fields when no file is uploaded, and reverses security encoding by using html_entity_decode() followed by unescaped output in the admin view.
Specifically, the submit_form() function skips nonce verification for users who are not logged in, the handleFileTypeFields() function fails to overwrite user-supplied values if no file is attached, and while htmlentities() is applied when storing data, html_entity_decode() reverses this on display.
Additionally, the form-data.php template outputs FileUpload values directly in href attributes without proper escaping (esc_url()), allowing unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the form Leads page.
How can this vulnerability impact me? :
This vulnerability allows unauthenticated attackers to inject malicious scripts that execute in the context of an administrator's browser when they view the form Leads page.
The impact includes potential compromise of administrator accounts, theft of sensitive information, and unauthorized actions performed with administrator privileges.
Because the vulnerability has a CVSS v3.1 base score of 7.2 with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality and integrity, it represents a significant security risk.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify how the vulnerability in the Brizy – Page Builder plugin impacts compliance with common standards and regulations such as GDPR or HIPAA.