CVE-2024-1291 in Brizy Page Builder Plugin
Summary
by MITRE • 03/13/2024
The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown URL parameter in all versions up to, and including, 2.4.40 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 04/12/2026
The Brizy – Page Builder plugin for WordPress represents a widely used visual editing solution that allows users to create and customize web pages through drag-and-drop interfaces. This plugin has been identified with a critical stored cross-site scripting vulnerability affecting all versions up to and including 2.4.40. The vulnerability specifically manifests through the Countdown URL parameter, which serves as an entry point for malicious code injection. The flaw stems from inadequate input sanitization mechanisms and insufficient output escaping practices within the plugin's codebase, creating a persistent security weakness that can be exploited by attackers with relatively low privileges.
The technical exploitation of this vulnerability occurs through the manipulation of the Countdown URL parameter, which is processed without proper validation or sanitization of user-supplied input. When an authenticated attacker with contributor-level access or higher submits malicious code through this parameter, the system fails to properly escape or filter the input before storing it in the database. This stored malicious content then executes whenever any user accesses the affected page, making it a persistent threat that can compromise multiple users over time. The vulnerability operates under CWE-79 which specifically addresses cross-site scripting flaws, and aligns with ATT&CK technique T1566.001 for initial access through malicious content.
The operational impact of this vulnerability extends beyond simple script execution, as it provides attackers with a vector for more sophisticated attacks including session hijacking, data exfiltration, and privilege escalation. Contributors and higher-level users can leverage this weakness to inject malicious JavaScript that can steal cookies, redirect users to phishing sites, or even execute commands on behalf of the compromised user. The persistent nature of stored XSS means that once the vulnerability is exploited, the malicious code remains active until manually removed from the database, potentially affecting all users who access the compromised pages. This makes the vulnerability particularly dangerous in multi-user environments where content creators and editors may inadvertently trigger the malicious scripts.
Mitigation strategies for this vulnerability require immediate attention from system administrators and WordPress site owners. The most effective immediate solution involves upgrading to a patched version of the Brizy plugin, as this addresses the root cause of the input sanitization and output escaping deficiencies. Additionally, implementing proper input validation at multiple levels including parameter filtering, content sanitization, and output escaping can help prevent similar issues. Network monitoring should be enhanced to detect suspicious URL parameter patterns, while role-based access controls should be reviewed to minimize the impact of compromised accounts. Organizations should also consider implementing content security policies and regular security audits of third-party plugins to prevent similar vulnerabilities from being introduced into their WordPress environments. The vulnerability demonstrates the critical importance of maintaining up-to-date security practices and the potential consequences of insufficient input validation in web applications.