3.5
Faible
CVE-2026-16068 The Brizy WordPress plugin before 2.8.19 does not properly restrict who can modify its site-global design data and does…
Description
The Brizy WordPress plugin before 2.8.19 does not properly restrict who can modify its site-global design data and does not sanitise part of that data before outputting it, allowing authenticated users with Author-level access and above to store arbitrary JavaScript that is then served unsanitised on the site's front-end pages and executes in the browser of every visitor, including administrators.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Brizy 2.8 | premières → < 2.8.19 | 2.8.19 |
Autres CVE de Brizy
Les 4 CVE de Brizy →
CVE-2026-16070
The Brizy WordPress plugin before 2.8.19 does not properly verify authorization on the object being modified before…
2.7
Faible
CVE-2026-16069
The Brizy WordPress plugin before 2.8.19 does not sanitize or escape featured-image focal-point coordinates submitted…
6.8
Moyenne
CVE-2026-14195
The Brizy WordPress plugin before 2.8.18 does not properly verify authorization on a request handler before returning…
2.7
Faible