6.8
Medium
CVE-2026-16069 The Brizy WordPress plugin before 2.8.19 does not sanitize or escape featured-image focal-point coordinates submitted…
Description
The Brizy WordPress plugin before 2.8.19 does not sanitize or escape featured-image focal-point coordinates submitted through one of its AJAX actions before storing them and later echoing them into HTML attributes in the post editor's Featured Image meta box, allowing users with the Contributor role or above to inject arbitrary web scripts that execute in the session of a higher-privileged user who opens the post for review.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Brizy 2.8 | earliest → < 2.8.19 | 2.8.19 |
Other CVEs of Brizy
The 4 CVEs of Brizy →
CVE-2026-16070
The Brizy WordPress plugin before 2.8.19 does not properly verify authorization on the object being modified before…
2.7
Low
CVE-2026-16068
The Brizy WordPress plugin before 2.8.19 does not properly restrict who can modify its site-global design data and does…
3.5
Low
CVE-2026-14195
The Brizy WordPress plugin before 2.8.18 does not properly verify authorization on a request handler before returning…
2.7
Low