CVE-2026-16069: Brizy - Page Builder < 2.8.19 - Contributor+ Stored XSS via Featured Image Focal Point
The Brizy WordPress plugin before 2.8.19 does not sanitize or escape featured-image focal-point coordinates submitted through one of its AJAX actions before storing them and later echoing them into HTML attributes in the post editor's Featured Image meta box, allowing users with the Contributor role or above to inject arbitrary web scripts that execute in the session of a higher-privileged user who opens the post for review.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-16069?
The severity of CVE-2026-16069 is rated at 43, indicating a medium risk level.
How do I fix CVE-2026-16069?
To fix CVE-2026-16069, update the Brizy Page Builder plugin to version 2.8.19 or later.
What type of vulnerability is CVE-2026-16069?
CVE-2026-16069 is categorized as a Stored Cross-Site Scripting (XSS) vulnerability.
Who is affected by CVE-2026-16069?
Users with the Contributor role in the WordPress site using Brizy Page Builder prior to version 2.8.19 are affected by CVE-2026-16069.
What is the impact of CVE-2026-16069?
The impact of CVE-2026-16069 allows attackers to execute arbitrary JavaScript code in the context of the user's browser.