Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

3 records

Vendor: themefusecom Component: Brizy-page Builder Clear all filters
TI-2021-15953 CVE-2021-38346 · GHSA-gq9p-f72g-3m6j

Brizy <= 2.3.11 Authenticated Unrestricted File Upload and Path Traversal

Priority MEDIUM 44

The Brizy Page Builder plugin <= 2.3.11 for WordPress allowed authenticated users to upload executable files to a location of their choice using the brizy_create_block_screenshot AJAX action.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01737 Published 2021-10-14 No fix listed CWE-79
TI-2021-15952 CVE-2021-38345 · GHSA-mg85-w8wc-5fvp

Brizy <= 1.0.125 and 1.0.127 – 2.3.11 Incorrect authorization checks allowing Post modification

Priority LOW 33

The Brizy Page Builder plugin <= 2.3.11 for WordPress used an incorrect authorization check that allowed any logged-in user accessing any endpoint in the wp-admin directory to modify the content of any existing post or p…

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.0075 Published 2021-10-14 No fix listed CWE-79
TI-2021-15951 CVE-2021-38344 · GHSA-f84h-684p-rggr

Brizy <= 2.3.11 Authenticated Stored Cross-Site Scripting

Priority LOW 29

The Brizy Page Builder plugin <= 2.3.11 for WordPress was vulnerable to stored XSS by lower-privileged users such as a subscribers.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00629 Published 2021-10-14 No fix listed CWE-79