CVE-2026-2585

MediumCVSS 6.4

Published: 18/09/2026(UTC)Updated: 19/09/2026(UTC)Translated: 18/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

5th percentile - higher than 5% of all known CVEs

Summary

The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rootAttributes' parameter in all versions up to and including 2.8.14 due to insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts that execute whenever a user accesses an injected page.

Risk Assessment

Attackers can steal session data, hijack user accounts, or spread malicious content, potentially leading to a full compromise of the WordPress site.

Recommendation

Immediately update the plugin to a patched version. Additionally, restrict content creation permissions to trusted users.

Other vulnerabilities in Brizy – Page Builder

CVE-2025-0969Medium
The Brizy – Page Builder plugin for WordPress up to version 2.7.16 is vulnerable to Sensitive Information Exposure via the get_users() function. This allows authenticated attackers with Contributor-level access or above to extract sensitive data including email addresses and hashed passwords of administrators.

Original NVD description (English source)

The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘rootAttributes’ parameter in all versions up to, and including, 2.8.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS