PT-2026-36594 · WordPress · Brizy
Momopon1415
·
Published
2026-05-02
·
Updated
2026-05-02
·
CVE-2026-5324
CVSS v3.1
7.2
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Brizy – Page Builder versions prior to 2.8.12
Description
Unauthenticated Stored Cross-Site Scripting occurs due to missing nonce verification for unauthenticated form submissions, insufficient handling of FileUpload fields when no file is uploaded, and the reversal of security encoding via
html entity decode() followed by unescaped output in the admin view. Specifically, the submit form() function skips nonce verification for non-logged-in users, and the handleFileTypeFields() function fails to overwrite user-supplied values when no file is attached. While htmlentities() is used during storage, html entity decode() reverses this on display, and the form-data.php template outputs FileUpload values directly in href attributes without esc url(). This allows unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the form Leads page.Recommendations
Update to a version later than 2.8.11.
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Brizy