Quick answers
- Is CVE-2026-16069 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-16069 being exploited in the wild.
- How severe is CVE-2026-16069?
- Medium severity, with a CVSS score of 6.8, published 4 August 2026.
- Which products and versions are affected?
- Brizy before 2.8.19.
- Is there a fix for CVE-2026-16069?
- A patch was published on 2026-08-04: Fixed in version 2.8.19 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-16069 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-16069?
- Check whether you run Brizy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The Brizy plugin contains a stored cross-site scripting (XSS) vulnerability in its featured image focal point handling. The vulnerability exists in the brizy_set_featured_image_focal_point AJAX action, which accepts pointX and pointY coordinates but fails to sanitize or validate these values before storing them in post metadata and later echoing them into HTML attributes within the WordPress post editor interface. An authenticated user with Contributor role or above can inject arbitrary HTML/JavaScript through the pointX parameter by submitting a crafted AJAX request. The malicious payload is stored in the post's brizy_attachment_focal_point metadata and executes with the privileges of any higher-privileged user (Editor, Administrator) who edits the post. The fix is to upgrade to version 2.8.19 or later.
Affected products
- Brizy Brizy before 2.8.19
Timeline
- 2026-07-27: disclosed
- 2026-08-04: patched: Fixed in version 2.8.19
- 2026-08-04: other: CVE-2026-16069 published