Unauthenticated Stored Cross-Site Scripting Vulnerability in Brizy Page Builder Plugin for WordPress

CVE-2026-5324

What is CVE-2026-5324?

The Brizy Page Builder plugin for WordPress is susceptible to unauthenticated stored Cross-Site Scripting (XSS) in all versions up to and including 2.8.11. This vulnerability arises from the absence of nonce verification for unauthenticated form submissions, lack of proper validation for FileUpload fields in instances where no file is submitted, and inadequate protection against security encoding through the use of html_entity_decode() prior to displaying user input in the admin area. Specifically, the submit_form() method bypasses nonce checks for non-logged-in visitors, and the handleFileTypeFields() function fails to sanitize user-supplied data without an uploaded file. While htmlentities() is utilized during storage, html_entity_decode() nullifies this safeguard upon output. Additionally, the form-data.php template presents FileUpload values unsafely in href attributes without the necessary esc_url() filtering, enabling unauthenticated attackers to inject malicious web scripts that execute when an administrator accesses the form Leads page.

References