CVE-2026-111844: WordPress Brizy plugin 2.8.23 - Cross Site Scripting (XSS) vulnerability
Published Oct 20, 2026
·Updated
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brizy Brizy brizy allows Stored XSS.This issue affects Brizy: 2.8.23.
Affected Software
1 affected component
Brizy Brizy=2.8.23
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Brizy pluginto a version that resolves this vulnerability.Fixed in 2.8.24
Event History
Oct 20, 2026
CVE Published
via MITRE·09:47 AM
Data Sourced
via MITRE·09:47 AM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·10:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The CVSS vector indicates that an attacker needs low-level privileges. The attack is network-reachable and has low attack complexity.
2
Does exploitation require another user to take an action?
Yes. The CVSS vector indicates that user interaction is required for successful exploitation.
3
What is the expected security impact if exploitation succeeds?
The vulnerability is rated medium severity with a CVSS score of 6.5. It can cause low impacts to confidentiality, integrity, and availability, and its scope is changed.