CVE-2026-14882

The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'brizy-compiled-sections' parameter in all versions up to and including 2.8.18 due to insufficient input sanitization and output escaping. An authenticated attacker with contributor-level access or above can inject arbitrary web scripts into pages that execute whenever a user visits the injected page.

An attacker with a contributor account can persistently inject malicious JavaScript into site pages, potentially leading to session theft, redirects, or administrator account takeover. Any WordPress site running the vulnerable plugin version is at risk.

Update the Brizy – Page Builder plugin to a version newer than 2.8.18 as soon as a fix is available, and limit contributor-level accounts to the minimum necessary.