Stored Cross-Site Scripting in Brizy Page Builder Plugin for WordPress

CVE-2024-1296

What is CVE-2024-1296?

The Brizy Page Builder plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability due to inadequate input sanitization and output escaping on user-supplied attributes. Authenticated attackers with contributor-level permissions and above can exploit this flaw through the plugin's block upload feature, allowing the injection of malicious scripts that execute when other users visit the compromised pages. This vulnerability affects all versions of the plugin up to and including 2.4.40, posing a significant risk to website security.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References