CVE-2026-16068

The Brizy WordPress plugin before 2.8.19 does not properly restrict who can modify its site-global design data and does not sanitise part of that data before outputting it, allowing authenticated users with Author-level access and above to store arbitrary JavaScript that is then served unsanitised on the site's front-end pages and executes in the browser of every visitor, including administrators.

CVSS v3.1

3.5 LOWCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

EPSS

0.14% chance of exploitation in the next 30 days, 4th percentile

Published

2026-08-04

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/e5eecbc1-1e6b-4915-9b42-869219db8ea6/

References

• CVE Record
• NVD entry

Related

• CVE-2026-16067
• CVE-2026-16069
• CVE-2026-16066
• CVE-2026-16070
• CVE-2026-16065
• CVE-2026-16073