# CVE-2026-16069: Brizy WordPress plugin stored XSS in featured image focal point

Source: https://junglewise.ai/threats/cve-2026-16069-brizy-wordpress-plugin-stored-xss-in-featured-image-focal-point  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-04. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-16069 · Severity: medium · CVSS 6.8 · Published 2026-08-04

Brizy is a popular page builder plugin for WordPress that allows users to visually design website content. The plugin fails to properly validate image focal point coordinates before saving and displaying them in the post editor, enabling contributors to inject malicious JavaScript code that executes when editors or administrators review the post. This could lead to account compromise or unauthorized actions within WordPress.

Technologies: [Brizy](https://junglewise.ai/threats/technologies/brizy). Vendors: [Brizy](https://junglewise.ai/threats/vendors/brizy).

## Quick answers

**Is CVE-2026-16069 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-16069 being exploited in the wild.

**How severe is CVE-2026-16069?** Medium severity, with a CVSS score of 6.8, published 4 August 2026.

**Which products and versions are affected?** Brizy before 2.8.19.

**Is there a fix for CVE-2026-16069?** A patch was published on 2026-08-04: Fixed in version 2.8.19 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-16069 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-16069?** Check whether you run Brizy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Brizy plugin contains a stored cross-site scripting (XSS) vulnerability in its featured image focal point handling. The vulnerability exists in the brizy_set_featured_image_focal_point AJAX action, which accepts pointX and pointY coordinates but fails to sanitize or validate these values before storing them in post metadata and later echoing them into HTML attributes within the WordPress post editor interface. An authenticated user with Contributor role or above can inject arbitrary HTML/JavaScript through the pointX parameter by submitting a crafted AJAX request. The malicious payload is stored in the post's brizy_attachment_focal_point metadata and executes with the privileges of any higher-privileged user (Editor, Administrator) who edits the post. The fix is to upgrade to version 2.8.19 or later.

## Affected products

- Brizy Brizy before 2.8.19

## Timeline

- 2026-07-27: disclosed
- 2026-08-04: patched: Fixed in version 2.8.19
- 2026-08-04: other: CVE-2026-16069 published

## References

- [https://wpscan.com/vulnerability/3fce478e-e240-46f4-b4a5-682eec11c7ad/](https://wpscan.com/vulnerability/3fce478e-e240-46f4-b4a5-682eec11c7ad/)

## Related threats

- [Brizy stored cross-site scripting vulnerability](https://junglewise.ai/threats/cve-2026-111844-improper-neutralization-of-input-during-web-page-generation)
- [Brizy WordPress plugin stored XSS via project code assets](https://junglewise.ai/threats/cve-2026-16068-brizy-wordpress-plugin-stored-xss-via-project-code-assets)