CVE-2026-16069
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
The Brizy WordPress plugin before version 2.8.19 does not sanitize or escape featured-image focal-point coordinates submitted through one of its AJAX actions before storing them and later echoing them into HTML attributes in the post editor's Featured Image meta box. Users with the Contributor role or above can inject arbitrary web scripts that execute in the session of a higher-privileged user who opens the post for review.
Risk Assessment
A user with Contributor role can execute malicious scripts in the session of an administrator or editor, potentially leading to account takeover or unauthorized actions.
Recommendation
Update the plugin to version 2.8.19 or later. Restrict user privileges and apply proper data escaping.
Other vulnerabilities in Brizy
See all- CVE-2026-14195Low
The Brizy WordPress plugin before version 2.8.18 does not properly verify authorization on a request handler before returning post content. Users with the Contributor role or higher can read the content of arbitrary posts, including other users' private, pending, and draft posts.
- CVE-2025-58594Medium
The Brizy plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 2.7.12.
Original NVD description (English source)
The Brizy WordPress plugin before 2.8.19 does not sanitize or escape featured-image focal-point coordinates submitted through one of its AJAX actions before storing them and later echoing them into HTML attributes in the post editor's Featured Image meta box, allowing users with the Contributor role or above to inject arbitrary web scripts that execute in the session of a higher-privileged user who opens the post for review.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS