Executive brief
Brizy is a popular page builder plugin for WordPress that allows users to visually design website content. The plugin fails to properly validate image focal point coordinates before saving and displaying them in the post editor, enabling contributors to inject malicious JavaScript code that executes when editors or administrators review the post. This could lead to account compromise or unauthorized actions within WordPress.
Technical details
The Brizy plugin contains a stored cross-site scripting (XSS) vulnerability in its featured image focal point handling. The vulnerability exists in the brizy_set_featured_image_focal_point AJAX action, which accepts pointX and pointY coordinates but fails to sanitize or validate these values before storing them in post metadata and later echoing them into HTML attributes within the WordPress post editor interface. An authenticated user with Contributor role or above can inject arbitrary HTML/JavaScript through the pointX parameter by submitting a crafted AJAX request. The malicious payload is stored in the post's brizy_attachment_focal_point metadata and executes with the privileges of any higher-privileged user (Editor, Administrator) who edits the post. The fix is to upgrade to version 2.8.19 or later.
Affected products
- Brizy Brizy before 2.8.19
Timeline
- 2026-07-27: disclosed
- 2026-08-04: patched: Fixed in version 2.8.19
- 2026-08-04: other: CVE-2026-16069 published