CVE-2024-10322: Brizy – Page Builder <= 2.6.8 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and including, 2.6.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-10322?
CVE-2024-10322 is a critical vulnerability due to its potential to allow authenticated attackers to execute stored cross-site scripting attacks.
How do I fix CVE-2024-10322?
To fix CVE-2024-10322, upgrade the Brizy – Page Builder plugin to version 2.6.9 or later, which addresses the input sanitization issues.
What systems are affected by CVE-2024-10322?
CVE-2024-10322 affects all versions of the Brizy – Page Builder plugin for WordPress up to and including version 2.6.8.
Can CVE-2024-10322 be exploited remotely?
CVE-2024-10322 can be exploited by authenticated attackers, but it requires access to the WordPress REST API for SVG file uploads.
What can be the impact of CVE-2024-10322 if exploited?
If exploited, CVE-2024-10322 can lead to malicious scripts being stored and executed in the context of a user's session, compromising the user's security.