Executive brief
Brizy is a popular page builder plugin for WordPress that allows content creators to design and publish web pages. A vulnerability allows authenticated contributors and administrators to inject malicious scripts into pages through the 'rootAttributes' parameter, which execute in the browsers of anyone viewing those pages. This could compromise site visitors and enable attackers to steal credentials, spread malware, or deface the website.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the Brizy page builder plugin affecting versions up to 2.8.14. The root cause is insufficient input sanitization and output escaping on the 'rootAttributes' parameter, allowing authenticated attackers with Contributor-level access or higher to inject arbitrary HTML/JavaScript. The attack vector requires user interaction (the attacker must create/edit a page and a victim must view it), but no network traversal is needed beyond normal WordPress access. When a user views an injected page, the malicious script executes in their browser with their privileges, potentially enabling session hijacking or further attacks. A patch is available in versions after 2.8.14.
Affected products
- Brizy Page Builder up to and including 2.8.14
Timeline
- 2026-09-18: disclosed: CVE-2026-2585 published on NVD