CVE-2026-41554
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
Bricks Builder has a Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This issue affects versions from n/a through 1.9.2 to 2.2.
Risk Assessment
An attacker could exploit this vulnerability to inject malicious JavaScript code, potentially leading to user data theft or session hijacking.
Recommendation
It is recommended to update Bricks Builder to the latest version to mitigate this vulnerability and implement appropriate XSS protection mechanisms.
Other vulnerabilities in Bricks Builder
See all- CVE-2026-118804High
Bricks Builder 2.4.3 and before contains a broken access control vulnerability that allows unauthenticated attackers to access restricted post content by submitting crafted post_status and post_type values in the originalQueryVars parameter to the POST /wp-json/bricks/v1/query_result REST endpoint using a publicly obtainable nonce. Attackers can set post_status to draft or private, or post_type to shop_coupon, to disclose unpublished posts, private content, and WooCommerce coupon data.
- CVE-2026-40723Medium
Bricks Builder versions up to 2.1.4 contain a vulnerability in access control that may allow subscribers unauthorized access to resources.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bricks Builder allows Reflected XSS. This issue affects Bricks Builder: from n/a through 1.9.2 to 2.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS