Stored Cross-Site Scripting in Brizy Page Builder Plugin for WordPress

CVE-2024-1296

Summary

The Brizy Page Builder plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability due to inadequate input sanitization and output escaping on user-supplied attributes. Authenticated attackers with contributor-level permissions and above can exploit this flaw through the plugin's block upload feature, allowing the injection of malicious scripts that execute when other users visit the compromised pages. This vulnerability affects all versions of the plugin up to and including 2.4.40, posing a significant risk to website security.

References