Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Brizy 2.8.19 Clear all filters
TI-2026-13449 CVE-2026-16070 · GHSA-w3xr-4xq6-f7jx

Brizy - Page Builder < 2.8.19 - Contributor+ Template Type Update via IDOR

Priority LOW 13

The Brizy WordPress plugin before 2.8.19 does not properly verify authorization on the object being modified before updating a template's type meta, validating a request parameter that is different from the one used in t…

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00281 Published 2026-08-04 Fixed in 2.8.19 CWE-639
TI-2026-13448 CVE-2026-16069 · GHSA-xpm5-253f-8839

Brizy - Page Builder < 2.8.19 - Contributor+ Stored XSS via Featured Image Focal Point

Priority LOW 32

The Brizy WordPress plugin before 2.8.19 does not sanitize or escape featured-image focal-point coordinates submitted through one of its AJAX actions before storing them and later echoing them into HTML attributes in the…

CVSS 3.1MEDIUM 6.8 Network High privileges User interaction EPSS 0.00431 Published 2026-08-04 Fixed in 2.8.19 CWE-79
TI-2026-13447 CVE-2026-16068 · GHSA-3qrh-q76v-gc9c

Brizy - Page Builder < 2.8.19 - Author+ Stored XSS via brizy_set_project Global Project Code Asset

Priority LOW 16

The Brizy WordPress plugin before 2.8.19 does not properly restrict who can modify its site-global design data and does not sanitise part of that data before outputting it, allowing authenticated users with Author-level…

CVSS 3.1LOW 3.5 Network High privileges User interaction EPSS 0.00242 Published 2026-08-04 Fixed in 2.8.19 CWE-79