CVE-2026-111844
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brizy Brizy brizy allows Stored XSS. This issue affects Brizy: 2.8.23.
Risk Assessment
An attacker can store a malicious script that executes in the browsers of site visitors, potentially leading to session theft or account takeover.
Recommendation
Update the Brizy plugin to a version newer than 2.8.23 containing the fix.
Other vulnerabilities in Brizy
See all- CVE-2026-16069Medium
The Brizy WordPress plugin before version 2.8.19 does not sanitize or escape featured-image focal-point coordinates submitted through one of its AJAX actions before storing them and later echoing them into HTML attributes in the post editor's Featured Image meta box. Users with the Contributor role or above can inject arbitrary web scripts that execute in the session of a higher-privileged user who opens the post for review.
- CVE-2026-14195Low
The Brizy WordPress plugin before version 2.8.18 does not properly verify authorization on a request handler before returning post content. Users with the Contributor role or higher can read the content of arbitrary posts, including other users' private, pending, and draft posts.
- CVE-2025-58594Medium
The Brizy plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 2.7.12.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brizy Brizy brizy allows Stored XSS.This issue affects Brizy: 2.8.23.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS