CVE-2026-16068
Brizy - Page Builder < 2.8.19 - Author+ Stored XSS via brizy_set_project Global Project Code Asset
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Brizy WordPress plugin before 2.8.19 does not properly restrict who can modify its site-global design data and does not sanitise part of that data before outputting it, allowing authenticated users with Author-level access and above to store arbitrary JavaScript that is then served unsanitised on the site's front-end pages and executes in the browser of every visitor, including administrators.
| Vendor | unknown |
| Product | brizy |
| Published | Aug 4, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown brizy
Be the first to know when new unknown vulnerabilities affecting unknown brizy are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Brizy
0 < 2.8.19
References
Credits
Muni Nitish Kumar Yaddala WPScan