September 20, 2026

CVE Watchtower

← Back to CVE List

CVE-2026-2585Wordfence

Description

The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘rootAttributes’ parameter in all versions up to, and including, 2.8.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity Level
MEDIUM (6.4)
Published Date
17/09/2026
Last Modified
17/09/2026
Exploitation Status
????
EPSS Score
0.16% (percentile 5.2%)

CVSS Base Metrics

CVSS v3 (3.x)
MEDIUM 6.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weaknesses (CWE)

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected & Patched Versions

ProductAffected VersionsPatched Version
Brizy – Page BuilderN/A2.8.15
📧Email Delivery — Threat intel straight to your inbox.
♾️Unlimited Vendors — Track your entire stack.
🚨All New CVEs — Be the first to know.
⚙️Custom EPSS — Filter noise, focus on risk.
💬Webhooks — Slack & Teams integration.
🚫Ad-Free — Uninterrupted experience.
📧Email Delivery — Threat intel straight to your inbox.
♾️Unlimited Vendors — Track your entire stack.
🚨All New CVEs — Be the first to know.
⚙️Custom EPSS — Filter noise, focus on risk.
💬Webhooks — Slack & Teams integration.
🚫Ad-Free — Uninterrupted experience.

References