Brizy – Page Builder vulnerabilities

The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'brizy-compiled-sections' parameter in all versions up to and including 2.8.18 due to insufficient input sanitization and output escaping. An authenticated attacker with contributor-level access or above can inject arbitrary web scripts into pages that execute whenever a user visits the injected page.

The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rootAttributes' parameter in all versions up to and including 2.8.14 due to insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts that execute whenever a user accesses an injected page.

The Brizy – Page Builder plugin for WordPress up to version 2.7.16 is vulnerable to Sensitive Information Exposure via the get_users() function. This allows authenticated attackers with Contributor-level access or above to extract sensitive data including email addresses and hashed passwords of administrators.