WordPress Brizy plugin cross-site scripting vulnerability (CNVD-2022-54353)

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. The WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in versions of the WordPress Brizy plugin prior to 2.4.2, whi...

CVE-2022-2041

The Brizy WordPress plugin before 2.4.2 does not sanitise and escape some element content, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks...

CVE-2022-2040

The Brizy WordPress plugin before 2.4.2 does not sanitise and escape some element URL, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks...

CVE-2022-2041

The Brizy WordPress plugin before 2.4.2 does not sanitise and escape some element content, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks...

WordPress plugin Brizy 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. The WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in versions of the WordPress Brizy plugin prior to 2.4.2, whi...

WordPress plugin Brizy 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. The WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in versions of the WordPress Brizy plugin prior to 2.4.2, whi...

PT-2022-14626 · WordPress · Brizy

Name of the Vulnerable Software and Affected Versions: Brizy WordPress plugin versions prior to 2.4.2 Description: The issue allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks due to the plugin's failure to sanitise and escape some element URLs...

PT-2022-14636 · WordPress · Brizy Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Brizy WordPress plugin versions prior to 2.4.2 Description: The issue allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks due to the lack of sanitization and escaping of some element content...

CVE-2021-38346

The Brizy Page Builder plugin = 2.3.11 for WordPress allowed authenticated users to upload executable files to a location of their choice using the brizycreateblockscreenshot AJAX action. The file would be named using the id parameter, which could be prepended with "../" to perform directory...

CVE-2021-38344 Brizy <= 2.3.11 Authenticated Stored Cross-Site Scripting

The Brizy Page Builder plugin = 2.3.11 for WordPress was vulnerable to stored XSS by lower-privileged users such as a subscribers. It was possible to add malicious JavaScript to a page by modifying the request sent to update the page via the brizyupdateitem AJAX action and adding JavaScript to th...

Brizy < 2.3.12 - Authenticated File Upload and Path Traversal

Using the brizycreateblockscreenshot AJAX action, it was possible to provide a filename using the id parameter, and populate the file contents via the ibsf parameter, which would be base64-decoded and written to the file. While the plugin appended .jpg to all uploaded filenames, a double extensio...

VulnCheck KEV: CVE-2020-36714

The Brizy plugin for WordPress is vulnerable to authorization bypass due to a incorrect capability check on the isadministrator function in versions up to, and including, 1.0.125. This makes it possible for authenticated attackers to access and interact with available AJAX functions...