WordPress Brizy – Page Builder plugin <= 2.3.11 - Incorrect authorization checks allowing Post modification vulnerability

Incorrect authorization checks allowing Post modification vulnerability discovered by Ramuel Gall WordFence in WordPress Brizy – Page Builder plugin versions = 2.3.11. Solution Update the WordPress Brizy – Page Builder plugin to the latest available version at least 2.3.12...

WordPress Brizy – Page Builder plugin <= 2.3.11 - Authenticated File Upload and Path Traversal vulnerability

Authenticated File Upload and Path Traversal vulnerability discovered by Ramuel Gall WordFence in WordPress Brizy – Page Builder plugin versions = 2.3.11. Solution Update the WordPress Brizy – Page Builder plugin to the latest available version at least 2.3.12...

Brizy - Page Builder < 1.0.126 - Improper Access Controls on AJAX Calls

The plugin does not properly check for access controls on AJAX calls, resulting in authenticated user with low privileges being able to gain access to the editor functions...

WordPress Brizy – Page Builder plugin <= 1.0.125 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by NinTechNet in WordPress Brizy – Page Builder plugin versions = 1.0.125. Solution Update the WordPress Brizy – Page Builder plugin to the latest available version at least 1.0.126...

VulnCheck KEV: CVE-2020-36714

The Brizy plugin for WordPress is vulnerable to authorization bypass due to a incorrect capability check on the isadministrator function in versions up to, and including, 1.0.125. This makes it possible for authenticated attackers to access and interact with available AJAX functions...

WordPress Brizy – Page Builder plugin <= 1.0.113 - Unauthenticated Site Settings Update vulnerability

Unauthenticated Site Settings Update vulnerability discovered by Riki Aji in WordPress Brizy – Page Builder plugin versions = 1.0.113. Solution Update the WordPress Brizy – Page Builder plugin to the latest available version at least 1.0.114...

Brizy - Page Builder < 1.0.114 - Unauthenticated Site Settings Update

Edit WPscanTeam The plugin fails to restrict access to the site settings page, allowing unauthenticated users to change them, such as site title, description as well as put XSS payload in the footer, leading to Unauthenticated Stored XSS issues. As we saw probes in the wild checking for the issue...

Brizy - Page Builder < 1.0.114 - Unauthenticated Site Settings Update

Edit WPscanTeam The plugin fails to restrict access to the site settings page, allowing unauthenticated users to change them, such as site title, description as well as put XSS payload in the footer, leading to Unauthenticated Stored XSS issues. As we saw probes in the wild checking for the issue...