Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:brizy:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Brizy (9529c08e-1308-53b6-af36-c9c09b380833) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-14195 |
vulnerable | 2026-09-16 04:33:12.319711 |
Brizy – Page Builder < 2.8.18 - Contributor+ Sensitive Information Disclosure via get_post_info
The Brizy WordPress plugin before 2.8.18 does not properly verify authorization on a request handler before returning post content, allowing users with the Contributor role or higher to read the content of arbitrary posts, including other users' private, pending, and draft posts.
Published: 2026-08-01T06:00:12.867Z
Updated: 2026-08-05T16:18:45.691Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-16068 |
vulnerable | 2026-09-16 04:32:57.054882 |
Brizy - Page Builder < 2.8.19 - Author+ Stored XSS via brizy_set_project Global Project Code Asset
The Brizy WordPress plugin before 2.8.19 does not properly restrict who can modify its site-global design data and does not sanitise part of that data before outputting it, allowing authenticated users with Author-level access and above to store arbitrary JavaScript that is then served unsanitised on the site's front-end pages and executes in the browser of every visitor, including administrators.
Published: 2026-08-04T06:00:11.871Z
Updated: 2026-08-04T17:39:20.942Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-16070 |
vulnerable | 2026-09-16 04:32:57.041776 |
Brizy - Page Builder < 2.8.19 - Contributor+ Template Type Update via IDOR
The Brizy WordPress plugin before 2.8.19 does not properly verify authorization on the object being modified before updating a template's type meta, validating a request parameter that is different from the one used in the write operation, allowing users with Contributor-level access and above to change the template-type assignment of templates owned by other users.
Published: 2026-08-04T06:00:12.248Z
Updated: 2026-08-04T14:21:23.949Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-16069 |
vulnerable | 2026-09-16 04:32:56.907754 |
Brizy - Page Builder < 2.8.19 - Contributor+ Stored XSS via Featured Image Focal Point
The Brizy WordPress plugin before 2.8.19 does not sanitize or escape featured-image focal-point coordinates submitted through one of its AJAX actions before storing them and later echoing them into HTML attributes in the post editor's Featured Image meta box, allowing users with the Contributor role or above to inject arbitrary web scripts that execute in the session of a higher-privileged user who opens the post for review.
Published: 2026-08-04T06:00:12.050Z
Updated: 2026-08-04T14:23:39.908Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.