CVE-2025-0969

MediumCVSS 6.5

Published: 13/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.39%

31th percentile - higher than 31% of all known CVEs

Summary

The Brizy – Page Builder plugin for WordPress up to version 2.7.16 is vulnerable to Sensitive Information Exposure via the get_users() function. This allows authenticated attackers with Contributor-level access or above to extract sensitive data including email addresses and hashed passwords of administrators.

Risk Assessment

Exposure of administrator passwords (even hashed) can lead to brute-force attacks or other password cracking methods, potentially resulting in administrator account takeover.

Recommendation

It is recommended to update the Brizy plugin to a version newer than 2.7.16 that includes a fix restricting access to user data.

Other vulnerabilities in Brizy – Page Builder

CVE-2026-2585Medium
The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rootAttributes' parameter in all versions up to and including 2.8.14 due to insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts that execute whenever a user accesses an injected page.

Original NVD description (English source)

The Brizy – Page Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.16 via the get_users() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including email addresses and hashed passwords of administrators.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS