CVE-2026-16069 in Brizy Plugin
Summary
by MITRE • 08/04/2026
The Brizy WordPress plugin before 2.8.19 does not sanitize or escape featured-image focal-point coordinates submitted through one of its AJAX actions before storing them and later echoing them into HTML attributes in the post editor's Featured Image meta box, allowing users with the Contributor role or above to inject arbitrary web scripts that execute in the session of a higher-privileged user who opens the post for review.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/04/2026
The Brizy WordPress plugin vulnerability represents a critical cross-site scripting flaw that arises from insufficient input sanitization and output escaping mechanisms within its AJAX handling processes. This security weakness affects versions prior to 2.8.19 and specifically targets the plugin's management of featured-image focal-point coordinates through AJAX actions. The vulnerability occurs when user-submitted data containing focal-point coordinates is stored without proper sanitization before being rendered into HTML attributes within the post editor interface. Attackers leveraging the Contributor role or higher privileges can exploit this weakness by injecting malicious JavaScript code into the focal-point coordinate fields, which then executes in the context of sessions belonging to higher-privileged users who access the post editor for review purposes.
The technical implementation of this vulnerability stems from the plugin's failure to properly validate and sanitize user input before storing it in the database and subsequently outputting it into HTML contexts. When a user with appropriate privileges submits focal-point coordinates through an AJAX endpoint, the data flows directly from the request parameters through the storage mechanism without undergoing proper sanitization or escaping procedures. This creates an environment where malicious payloads can be persisted and later executed when the stored coordinates are rendered within HTML attributes in the Featured Image meta box. The vulnerability is classified as a classic XSS attack vector that operates through unescaped output within HTML contexts, making it particularly dangerous due to its ability to target privileged users who interact with the post editor interface.
The operational impact of this vulnerability extends beyond simple script execution as it enables attackers to potentially escalate privileges or conduct session hijacking attacks against administrators and editors who frequently use the Brizy plugin. When higher-privileged users open posts for review, their browser sessions become vulnerable to malicious script injection that could capture cookies, redirect traffic, or perform unauthorized actions within the WordPress administration interface. The attack requires minimal privileges since Contributors can execute this exploit, making it particularly concerning for sites with multiple contributors who may not be properly vetted or monitored. This vulnerability undermines the security model of WordPress by allowing users with relatively low privileges to compromise the sessions of more privileged users through a carefully crafted injection payload.
Mitigation strategies should focus on immediate patching to version 2.8.19 or later where the sanitization and escaping mechanisms have been properly implemented. Organizations should also implement additional monitoring for suspicious AJAX requests related to focal-point coordinate handling within the Brizy plugin context. The vulnerability aligns with CWE-79 which categorizes cross-site scripting flaws as a result of insufficient input validation and output escaping, while also mapping to ATT&CK technique T1566 which covers social engineering through malicious content injection. Security teams should enforce principle of least privilege by limiting contributor access to sensitive plugin functionalities where possible, though the most effective defense remains the immediate application of the vendor-provided security patch. Additionally, organizations should consider implementing Content Security Policy headers to provide additional protection layers against script execution vulnerabilities even when other controls fail.