CVE-2026-16068: Brizy - Page Builder < 2.8.19 - Author+ Stored XSS via brizy_set_project Global Project Code Asset
Published Aug 4, 2026
·Updated
The Brizy WordPress plugin before 2.8.19 does not properly restrict who can modify its site-global design data and does not sanitise part of that data before outputting it, allowing authenticated users with Author-level access and above to store arbitrary JavaScript that is then served unsanitised on the site's front-end pages and executes in the browser of every visitor, including administrators.
Affected Software
1 affected component
Brizy - Page Builder<2.8.19
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Brizy - Page Builderto a version that resolves this vulnerability.Fixed in 2.8.19 - Compensating control
Restrict Brizy site-global design data modification rights so only trusted users can modify the global project code/asset (limit Author-level and above access) until the plugin is upgraded.
Event History
Aug 4, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness