3.5
Low
CVE-2026-16068 The Brizy WordPress plugin before 2.8.19 does not properly restrict who can modify its site-global design data and does…
Description
The Brizy WordPress plugin before 2.8.19 does not properly restrict who can modify its site-global design data and does not sanitise part of that data before outputting it, allowing authenticated users with Author-level access and above to store arbitrary JavaScript that is then served unsanitised on the site's front-end pages and executes in the browser of every visitor, including administrators.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Brizy 2.8 | earliest → < 2.8.19 | 2.8.19 |
Other CVEs of Brizy
The 4 CVEs of Brizy →
CVE-2026-16070
The Brizy WordPress plugin before 2.8.19 does not properly verify authorization on the object being modified before…
2.7
Low
CVE-2026-16069
The Brizy WordPress plugin before 2.8.19 does not sanitize or escape featured-image focal-point coordinates submitted…
6.8
Medium
CVE-2026-14195
The Brizy WordPress plugin before 2.8.18 does not properly verify authorization on a request handler before returning…
2.7
Low