CVE-2024-1293 in Brizy Page Builder Plugin
Summary
by MITRE • 03/13/2024
The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the embedded media custom block in all versions up to, and including, 2.4.40 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 04/12/2026
The Brizy – Page Builder plugin for WordPress represents a widely used visual editing solution that allows users to create complex web pages through drag-and-drop interfaces. This vulnerability affects all versions up to and including 2.4.40, making it a significant concern for WordPress installations that rely on this plugin for content creation and management. The plugin's embedded media custom block functionality serves as the attack vector for this stored cross-site scripting vulnerability, which fundamentally compromises the security of websites using this tool.
The technical flaw stems from inadequate input sanitization and output escaping mechanisms within the plugin's codebase. When authenticated attackers with contributor-level access or higher submit malicious content through the embedded media custom block, the system fails to properly validate or escape the input before storing it in the database. This stored malicious content then executes whenever any user accesses the affected page, creating a persistent threat that can affect all visitors to the compromised website. The vulnerability specifically targets the sanitization processes that should normally prevent malicious scripts from being stored and executed.
The operational impact of this vulnerability extends beyond simple script execution, as it can enable attackers to perform various malicious activities including credential theft, session hijacking, and data exfiltration. Since the attack requires only contributor-level access, it represents a particularly concerning threat vector because contributors typically have significant privileges within WordPress environments. This means that even relatively low-privilege users within the WordPress system can exploit this vulnerability to gain broader access to website functionality and potentially compromise entire websites. The stored nature of the XSS attack means that the malicious payload persists even after the initial injection, creating a long-term threat that can affect multiple users over time.
Organizations should immediately update to the latest version of the Brizy plugin to remediate this vulnerability, as no workarounds exist for this specific flaw. The vulnerability aligns with CWE-79 which describes cross-site scripting flaws that occur when untrusted data is sent to a web browser without proper validation or escaping. From an ATT&CK perspective, this vulnerability maps to T1566.001 which covers spearphishing attachments and T1071.001 for application layer protocol usage. Security teams should implement comprehensive monitoring for suspicious content uploads and conduct thorough security assessments of all WordPress plugins to identify similar vulnerabilities. The incident also highlights the importance of principle of least privilege in WordPress environments, as restricting contributor access to only necessary functions can limit the potential impact of such vulnerabilities.