{"id":"CVE-2026-5324","aliases":["EUVD-2026-26764","GHSA-p8xr-fh24-8289"],"status":"published","title":"Brizy – Page Builder \u003c= 2.8.11 - Unauthenticated Stored Cross-Site Scripting via FileUpload Field Value","description":"The Brizy – Page Builder plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in all versions up to, and including, 2.8.11 This is due to a combination of missing nonce verification for unauthenticated form submissions, insufficient handling of FileUpload fields when no file is uploaded, and the reversal of security encoding via html_entity_decode() followed by unescaped output in the admin view. The submit_form() function skips nonce verification for non-logged-in users (api.php:198). The handleFileTypeFields() function fails to overwrite user-supplied values when no file is attached. While htmlentities() is applied during storage, html_entity_decode() reverses this on display (form-entries.php:79). The form-data.php template outputs FileUpload values directly in href attributes without esc_url(). This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the form Leads page.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00401,"percentile":0.3466,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2026-05-02T08:27:05Z","modified":"2026-06-17T10:58:49Z","products":[{"vendor":"themefusecom","product":"brizy – page builder"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78ec499e-5edd-4f11-9090-f79868864fee?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/brizy/tags/2.7.24/admin/views/form-data.php#L11"},{"url":"https://plugins.trac.wordpress.org/browser/brizy/tags/2.7.24/admin/form-entries.php#L79"},{"url":"https://plugins.trac.wordpress.org/browser/brizy/trunk/admin/views/form-data.php#L11"},{"url":"https://plugins.trac.wordpress.org/browser/brizy/tags/2.7.24/editor/forms/api.php#L198"},{"url":"https://plugins.trac.wordpress.org/browser/brizy/tags/2.7.24/editor/forms/api.php#L295"},{"url":"https://plugins.trac.wordpress.org/changeset/3502206/brizy/trunk/admin/views/form-data.php"},{"url":"https://plugins.trac.wordpress.org/changeset?old_path=%2Fbrizy/tags/2.8.11\u0026new_path=%2Fbrizy/tags/2.8.12"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5324"},{"url":"https://github.com/advisories/GHSA-p8xr-fh24-8289"}],"sources":{"cve":[{"id":"CVE-2026-5324","title":"Brizy – Page Builder \u003c= 2.8.11 - Unauthenticated Stored Cross-Site Scripting via FileUpload Field Value","description":"The Brizy – Page Builder plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in all versions up to, and including, 2.8.11 This is due to a combination of missing nonce verification for unauthenticated form submissions, insufficient handling of FileUpload fields when no file is uploaded, and the reversal of security encoding via html_entity_decode() followed by unescaped output in the admin view. The submit_form() function skips nonce verification for non-logged-in users (api.php:198). The handleFileTypeFields() function fails to overwrite user-supplied values when no file is attached. While htmlentities() is applied during storage, html_entity_decode() reverses this on display (form-entries.php:79). The form-data.php template outputs FileUpload values directly in href attributes without esc_url(). This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the form Leads page.","status":"published","published":"2026-05-02T08:27:05.238Z","modified":"2026-05-04T17:51:44.7Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T13:39:39.001586Z"}],"euvd":[{"id":"EUVD-2026-26764","description":"The Brizy – Page Builder plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in all versions up to, and including, 2.8.11 This is due to a combination of missing nonce verification for unauthenticated form submissions, insufficient handling of FileUpload fields when no file is uploaded, and the reversal of security encoding via html_entity_decode() followed by unescaped output in the admin view. The submit_form() function skips nonce verification for non-logged-in users (api.php:198). The handleFileTypeFields() function fails to overwrite user-supplied values when no file is attached. While htmlentities() is applied during storage, html_entity_decode() reverses this on display (form-entries.php:79). The form-data.php template outputs FileUpload values directly in href attributes without esc_url(). This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the form Leads page.","status":"published","published":"2026-05-02T08:27:05Z","modified":"2026-05-04T17:51:44Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T19:05:17.549765Z"}],"ghsa":[{"id":"GHSA-p8xr-fh24-8289","title":"The Brizy – Page Builder plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site...","description":"The Brizy – Page Builder plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in all versions up to, and including, 2.8.11 This is due to a combination of missing nonce verification for unauthenticated form submissions, insufficient handling of FileUpload fields when no file is uploaded, and the reversal of security encoding via html_entity_decode() followed by unescaped output in the admin view. The submit_form() function skips nonce verification for non-logged-in users (api.php:198). The handleFileTypeFields() function fails to overwrite user-supplied values when no file is attached. While htmlentities() is applied during storage, html_entity_decode() reverses this on display (form-entries.php:79). The form-data.php template outputs FileUpload values directly in href attributes without esc_url(). This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the form Leads page.","status":"published","published":"2026-05-02T09:31:16Z","modified":"2026-05-02T09:31:21Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:07:53.39389Z"}],"nvd":[{"id":"CVE-2026-5324","description":"The Brizy – Page Builder plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in all versions up to, and including, 2.8.11 This is due to a combination of missing nonce verification for unauthenticated form submissions, insufficient handling of FileUpload fields when no file is uploaded, and the reversal of security encoding via html_entity_decode() followed by unescaped output in the admin view. The submit_form() function skips nonce verification for non-logged-in users (api.php:198). The handleFileTypeFields() function fails to overwrite user-supplied values when no file is attached. While htmlentities() is applied during storage, html_entity_decode() reverses this on display (form-entries.php:79). The form-data.php template outputs FileUpload values directly in href attributes without esc_url(). This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the form Leads page.","status":"published","published":"2026-05-02T09:16:22.477Z","modified":"2026-06-17T10:58:49.207Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:17.022502Z"}]}}