Brizy – Page Builder <= 2.8.11 - Unauthenticated Stored Cross-Site Scripting via FileUpload Field Value
Summary
| CVE | CVE-2026-5324 |
|---|---|
| State | PUBLISHED |
| Assigner | Wordfence |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-05-02 09:16:22 UTC |
| Updated | 2026-05-02 09:16:22 UTC |
| Description | The Brizy – Page Builder plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in all versions up to, and including, 2.8.11 This is due to a combination of missing nonce verification for unauthenticated form submissions, insufficient handling of FileUpload fields when no file is uploaded, and the reversal of security encoding via html_entity_decode() followed by unescaped output in the admin view. The submit_form() function skips nonce verification for non-logged-in users (api.php:198). The handleFileTypeFields() function fails to overwrite user-supplied values when no file is attached. While htmlentities() is applied during storage, html_entity_decode() reverses this on display (form-entries.php:79). The form-data.php template outputs FileUpload values directly in href attributes without esc_url(). This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the form Leads page. |
Risk And Classification
Primary CVSS: v3.1 7.2 HIGH from [email protected]
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Problem Types: CWE-79 | CWE-79 CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 7.2 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N |
| 3.1 | CNA | DECLARED | 7.2 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
ChangedConfidentiality
LowIntegrity
LowAvailability
NoneCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Themefusecom | Brizy Page Builder | affected 2.8.11 semver | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| plugins.trac.wordpress.org/browser/brizy/tags/2.7.24/admin/views/form-data.php | [email protected] | plugins.trac.wordpress.org | |
| plugins.trac.wordpress.org/changeset/3502206/brizy/trunk/admin/views/form-data.php | [email protected] | plugins.trac.wordpress.org | |
| plugins.trac.wordpress.org/browser/brizy/tags/2.7.24/admin/form-entries.php | [email protected] | plugins.trac.wordpress.org | |
| plugins.trac.wordpress.org/browser/brizy/tags/2.7.24/editor/forms/api.php | [email protected] | plugins.trac.wordpress.org | |
| plugins.trac.wordpress.org/changeset | [email protected] | plugins.trac.wordpress.org | |
| www.wordfence.com/threat-intel/vulnerabilities/id/78ec499e-5edd-4f11-9090-f7986... | [email protected] | www.wordfence.com | |
| plugins.trac.wordpress.org/browser/brizy/trunk/admin/views/form-data.php | [email protected] | plugins.trac.wordpress.org | |
| plugins.trac.wordpress.org/browser/brizy/tags/2.7.24/editor/forms/api.php | [email protected] | plugins.trac.wordpress.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: momopon1415 (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2026-04-01T13:32:30.000Z | Vendor Notified |
| CNA | 2026-05-01T20:15:49.000Z | Disclosed |
There are currently no legacy QID mappings associated with this CVE.