368 matches found
Unyson < 2.7.27 - Cross Site Scripting
The plugin does not sanitise and escape the QUERYSTRING before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting in browsers which do not encode characters id: CVE-2022-2219 info: name: Unyson 2.7.27 - Cross Site Scripting author: r3Y3r53 severity: high description:...
CVE-2026-16068
The Brizy WordPress plugin before 2.8.19 does not properly restrict who can modify its site-global design data and does not sanitise part of that data before outputting it, allowing authenticated users with Author-level access and above to store arbitrary JavaScript that is then served unsanitise...
CVE-2026-16069
The Brizy WordPress plugin before 2.8.19 does not sanitize or escape featured-image focal-point coordinates submitted through one of its AJAX actions before storing them and later echoing them into HTML attributes in the post editor's Featured Image meta box, allowing users with the Contributor...
CVE-2026-16070
The Brizy WordPress plugin before 2.8.19 does not properly verify authorization on the object being modified before updating a template's type meta, validating a request parameter that is different from the one used in the write operation, allowing users with Contributor-level access and above to...
EUVD-2026-52595
The Brizy WordPress plugin before 2.8.19 does not properly verify authorization on the object being modified before updating a template's type meta, validating a request parameter that is different from the one used in the write operation, allowing users with Contributor-level access and above to...
CVE-2026-16069
The Brizy WordPress plugin before 2.8.19 does not sanitize or escape featured-image focal-point coordinates submitted via an AJAX action, and later echoes them into HTML attributes in the post editor’s Featured Image meta box. This allows users with the Contributor role or above to inject arbitra...
EUVD-2026-52594
The Brizy WordPress plugin before 2.8.19 does not sanitize or escape featured-image focal-point coordinates submitted through one of its AJAX actions before storing them and later echoing them into HTML attributes in the post editor's Featured Image meta box, allowing users with the Contributor...
CVE-2026-16070
The CVE-2026-16070 relates to the Brizy WordPress plugin (before 2.8.19). The vulnerability arises because it does not properly verify authorization when updating a template’s type meta, validating a request parameter different from the one used in the write operation. This IDOR-like flaw enables...
CVE-2026-16069 Brizy - Page Builder < 2.8.19 - Contributor+ Stored XSS via Featured Image Focal Point
The Brizy WordPress plugin before 2.8.19 does not sanitize or escape featured-image focal-point coordinates submitted through one of its AJAX actions before storing them and later echoing them into HTML attributes in the post editor's Featured Image meta box, allowing users with the Contributor...
CVE-2026-16070 Brizy - Page Builder < 2.8.19 - Contributor+ Template Type Update via IDOR
The Brizy WordPress plugin before 2.8.19 does not properly verify authorization on the object being modified before updating a template's type meta, validating a request parameter that is different from the one used in the write operation, allowing users with Contributor-level access and above to...
CVE-2026-16068
The Brizy WordPress plugin before 2.8.19 has an access-control and input-sanitization flaw: authenticated users with Author-level access and above can modify site-global design data and inject arbitrary JavaScript. This code is stored and served unsanitised on front-end pages, enabling XSS for al...
EUVD-2026-52593
The Brizy WordPress plugin before 2.8.19 does not properly restrict who can modify its site-global design data and does not sanitise part of that data before outputting it, allowing authenticated users with Author-level access and above to store arbitrary JavaScript that is then served unsanitise...
CVE-2026-16068 Brizy - Page Builder < 2.8.19 - Author+ Stored XSS via brizy_set_project Global Project Code Asset
The Brizy WordPress plugin before 2.8.19 does not properly restrict who can modify its site-global design data and does not sanitise part of that data before outputting it, allowing authenticated users with Author-level access and above to store arbitrary JavaScript that is then served unsanitise...
CVE-2026-14195
The Brizy WordPress plugin before 2.8.18 does not properly verify authorization on a request handler before returning post content, allowing users with the Contributor role or higher to read the content of arbitrary posts, including other users' private, pending, and draft posts...
CVE-2026-14195
The Brizy WordPress plugin before 2.8.18 does not properly verify authorization on a request handler before returning post content, allowing users with the Contributor role or higher to read the content of arbitrary posts, including other users' private, pending, and draft posts...
CVE-2026-14195
Summary: CVE-2026-14195 affects the Brizy WordPress plugin prior to 2.8.18. The issue is an authorization check gap on a request handler that returns post content, allowing users with the Contributor role or higher to read arbitrary posts, including private, pending, and draft posts from other us...
WordPress Brizy plugin < 2.8.18 - Contributor+ Sensitive Information Disclosure vulnerability
Contributor+ Sensitive Information Disclosure vulnerability discovered by Mustafa Ahmed in WordPress Plugin Brizy versions 2.8.18...
CVE-2026-14195 Brizy – Page Builder < 2.8.18 - Contributor+ Sensitive Information Disclosure via get_post_info
The Brizy WordPress plugin before 2.8.18 does not properly verify authorization on a request handler before returning post content, allowing users with the Contributor role or higher to read the content of arbitrary posts, including other users' private, pending, and draft posts...
EUVD-2026-51704
The Brizy WordPress plugin before 2.8.18 does not properly verify authorization on a request handler before returning post content, allowing users with the Contributor role or higher to read the content of arbitrary posts, including other users' private, pending, and draft posts...
WordPress Brizy – Page Builder plugin <= 2.8.11 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by momopon1415 in WordPress Plugin Brizy versions = 2.8.11...