CVE-2026-16068 in Brizy Plugin
Summary
by MITRE • 08/04/2026
The Brizy WordPress plugin before 2.8.19 does not properly restrict who can modify its site-global design data and does not sanitise part of that data before outputting it, allowing authenticated users with Author-level access and above to store arbitrary JavaScript that is then served unsanitised on the site's front-end pages and executes in the browser of every visitor, including administrators.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/04/2026
The Brizy WordPress plugin vulnerability represents a critical security flaw that enables persistent cross-site scripting attacks through improper access controls and data sanitization failures. This vulnerability affects versions prior to 2.8.19 and specifically targets the plugin's handling of site-global design data, creating a dangerous privilege escalation vector that allows authors and higher-level users to inject malicious code into the frontend of affected websites. The flaw stems from inadequate input validation and output sanitization mechanisms within the plugin's core functionality.
The technical implementation of this vulnerability involves multiple layers of security failure that align with common weakness patterns documented in the CWE database. The plugin fails to properly enforce role-based access controls for design data modifications, allowing users with Author level permissions and above to manipulate global site configuration elements. This represents a classic case of insufficient authorization checks where the system does not adequately verify user privileges before permitting modifications to critical frontend components. Additionally, the vulnerability demonstrates poor output sanitization practices that directly correlate to CWE-79 which describes improper neutralization of input during web page generation.
The operational impact of this vulnerability extends far beyond simple XSS exploitation, creating a persistent threat vector that can compromise every visitor to the affected website including administrators who may not even be aware they are visiting compromised pages. When malicious JavaScript is stored in the design data and subsequently rendered on frontend pages, it executes in the context of every user's browser session, potentially enabling session hijacking, credential theft, or more sophisticated attacks such as phishing or malware distribution. This makes the vulnerability particularly dangerous in environments where administrators frequently visit their own sites or where multiple users with varying privilege levels access the same installation.
The attack surface for this vulnerability is significantly expanded by the fact that it requires only Author-level privileges to exploit, which many WordPress installations grant to users who should not have such broad modification capabilities. This misconfiguration creates a dangerous precedent where content creators can inadvertently or maliciously compromise entire websites through legitimate plugin functionality. The vulnerability also aligns with ATT&CK technique T1059.007 for scripting languages and T1566 for phishing, as the stored JavaScript can be used to redirect users to malicious sites or capture sensitive information from legitimate website visits.
Mitigation strategies should include immediate patching to version 2.8.19 or later, which addresses the core access control and sanitization issues. Administrators should also implement additional monitoring of design data modifications and consider role restriction policies that limit who can modify global site elements. The vulnerability highlights the importance of proper input validation and output encoding practices, particularly for content management systems where users with varying privilege levels interact with shared resources. Organizations should conduct thorough security assessments of all installed plugins to identify similar access control weaknesses and implement comprehensive logging of administrative activities to detect potential exploitation attempts.
This vulnerability serves as a reminder of the critical importance of sanitizing user-provided data before rendering it in web contexts, particularly for systems that allow non-administrative users to modify site-wide configuration elements. The flaw demonstrates how seemingly minor access control oversights can create significant security risks when combined with inadequate output sanitization practices. Organizations should prioritize regular security updates and maintain awareness of plugin security advisories while implementing robust monitoring and incident response procedures to detect and respond to similar vulnerabilities in their web applications.