Extension WordPress
Vulnérabilités Brizy – Page Builder
Cette page rassemble les failles publiées pour Brizy – Page Builder, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de Brizy – Page Builder
31 fiches
Brizy – Page Builder <= 2.8.11 – Unauthenticated Stored Cross-Site Scripting via FileUpload Field Value
The Brizy – Page Builder plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in all versions up to, and including, 2.8.11 This is due to a combination of missing nonce verification for unauthenticated form submissions, insufficient…
*-2.8.11
2.8.12
01/05/2026
Brizy <= 2.7.23 – Missing Authorization
The Brizy plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 2.7.23. This makes it possible for authenticated attackers, with contributor-level access and above,…
*-2.7.23
2.7.24
22/02/2026
Brizy – Page Builder <= 2.7.16 – Authenticated (Contributor+) Sensitive Information Exposure via get_users Function
The Brizy – Page Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.16 via the get_users() function. This makes it possible for authenticated attackers, with Contributor-level access and above,…
*-2.7.16
2.7.17
12/12/2025
Brizy <= 2.7.12 – Missing Authorization
The Brizy – Page Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.7.12. This makes it possible for authenticated attackers, with…
*-2.7.12
2.7.13
03/09/2025
Brizy <= 2.6.20 – Missing Authorization to Unauthenticated Limited File Upload
The Brizy – Page Builder plugin for WordPress is vulnerable to limited file uploads due to missing authorization on process_external_asset_urls function as well as missing path validation in store_file function in all versions up to, and including, 2.6.20.…
*-2.6.20
2.6.21
28/07/2025
Brizy <= 2.7.7 – Authenticated (Contributor+) Stored Cross-Site Scripting
The Brizy plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.7.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above,…
*-2.7.7
2.7.8
04/04/2025
Brizy – Page Builder <= 2.6.8 – Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and including, 2.6.8 due to insufficient input sanitization and output escaping. This makes…
*-2.6.8
2.6.9
12/02/2025
Brizy – Page Builder <= 2.6.4 – Authenticated (Contributor+) Arbitrary File Upload via storeUploads
The Brizy – Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'storeUploads' function in all versions up to, and including, 2.6.4. This makes it possible for authenticated…
*-2.6.4
2.6.5
11/02/2025
Brizy – Page Builder <= 2.5.1 – Cross-Site Request Forgery
The Brizy – Page Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.1. This is due to missing or incorrect nonce validation on form submissions. This makes it possible…
*-2.5.1
2.5.2
07/08/2024
Brizy – Page Builder <= 2.4.44 – Authenticated (Contributor+) Arbitrary File Upload
The Brizy – Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file extension validation in the validateImageContent function called via storeImages in all versions up to, and including, 2.4.43. This makes it…
*-2.4.44
2.4.45
17/07/2024
Brizy – Page Builder <= 2.4.44 – Missing Authorization to Authenticated (Contributor+) Post Modification
The Brizy – Page Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_item' function in all versions up to, and including, 2.4.44. This makes it possible for…
*-2.4.44
2.4.45
15/07/2024
Brizy – Page Builder <= 2.4.43 – Authenticated(Contributor+) Stored Cross-Site Scripting via Form Functionality
The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's contact form widget error message and redirect URL in all versions up to, and including, 2.4.43 due to insufficient input sanitization…
*-2.4.43
2.4.44
04/06/2024
Brizy – Page Builder <= 2.4.43 – Unauthenticated Stored Cross-Site Scripting via Form
The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form name values in all versions up to, and including, 2.4.43 due to insufficient input sanitization and output escaping. This makes it…
*-2.4.43
2.4.44
04/06/2024
Brizy – Page Builder <= 2.4.43 – Authenticated (Contributor+) Store Cross-Site Scripting via Widget Link To URL
The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Link To' field of multiple widgets in all versions up to, and including, 2.4.43 due to insufficient input sanitization and output escaping…
*-2.4.43
2.4.44
04/06/2024
Brizy – Page Builder <= 2.4.43 – Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Attributes
The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Custom Attributes for blocks in all versions up to, and including, 2.4.43 due to insufficient input sanitization and output escaping. This…
*-2.4.43
2.4.44
04/06/2024
Brizy – Page Builder <= 2.4.43 – Missing Authorization
The Brizy – Page Builder plugin for WordPress is vulnerable to unauthorized plugin setting update due to a missing capability check on the functions action_request_disable, action_change_template, and action_request_enable in all versions up to, and including, 2.4.43. This makes…
*-2.4.43
2.4.44
22/05/2024
Brizy – Page Builder <= 2.4.41 – Authenticated(Contributor+) Stored Cross-Site Scripting
The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post content in all versions up to, and including, 2.4.41 due to insufficient input sanitization performed only on the client side and insufficient…
*-2.4.41
2.4.42
06/05/2024
Brizy – Page Builder <= 2.4.40 – Authenticated (Contributor+) Arbitrary File Upload
The Brizy – Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the storeImages function in all versions up to, and including, 2.4.40. This makes it possible for authenticated…
*-2.4.40
2.4.41
23/02/2024
Brizy – Page Builder <= 2.4.40 – Authenticated (Contributor+) Stored Cross-Site Scripting
The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown URL parameter in all versions up to, and including, 2.4.40 due to insufficient input sanitization and output escaping. This makes it…
*-2.4.40
2.4.41
23/02/2024
Brizy – Page Builder <= 2.4.40 – Authenticated (Contributor+) Stored Cross-Site Scripting
The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the embedded media custom block in all versions up to, and including, 2.4.40 due to insufficient input sanitization and output escaping. This makes…
*-2.4.40
2.4.41
23/02/2024
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.