6.8
Moyenne
CVE-2026-16069 The Brizy WordPress plugin before 2.8.19 does not sanitize or escape featured-image focal-point coordinates submitted…
Description
The Brizy WordPress plugin before 2.8.19 does not sanitize or escape featured-image focal-point coordinates submitted through one of its AJAX actions before storing them and later echoing them into HTML attributes in the post editor's Featured Image meta box, allowing users with the Contributor role or above to inject arbitrary web scripts that execute in the session of a higher-privileged user who opens the post for review.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Brizy 2.8 | premières → < 2.8.19 | 2.8.19 |
Autres CVE de Brizy
Les 4 CVE de Brizy →
CVE-2026-16070
The Brizy WordPress plugin before 2.8.19 does not properly verify authorization on the object being modified before…
2.7
Faible
CVE-2026-16068
The Brizy WordPress plugin before 2.8.19 does not properly restrict who can modify its site-global design data and does…
3.5
Faible
CVE-2026-14195
The Brizy WordPress plugin before 2.8.18 does not properly verify authorization on a request handler before returning…
2.7
Faible