Description
The Brizy – Page Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_item' function in all versions up to, and including, 2.4.44. This makes it possible for authenticated attackers, with contributor access and above, to modify the content of arbitrary published posts, which includes the ability to insert malicious JavaScript.
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| themefusecom | Brizy – Page Builder | unaffected |
|
No data.
No data available yet.
Remediation
No remediation available yet.
Tracking
Sign in to view the affected projects.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2024-17659 | The Brizy – Page Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_item' function in all versions up to, and including, 2.4.44. This makes it possible for authenticated attackers, with contributor access and above, to modify the content of arbitrary published posts, which includes the ability to insert malicious JavaScript. |
References
History
Thu, 16 Jan 2025 15:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Brizy
Brizy brizy |
|
| Weaknesses | CWE-862 | |
| CPEs | cpe:2.3:a:brizy:brizy:*:*:*:*:free:wordpress:*:* | |
| Vendors & Products |
Brizy
Brizy brizy |
MITRE
Status: PUBLISHED
Assigner: Wordfence
Published:
Updated: 2026-04-08T17:18:28.619Z
Reserved: 2024-02-27T17:36:56.260Z
Link: CVE-2024-1937
Vulnrichment
Updated: 2024-08-01T18:56:22.641Z
NVD
Status : Modified
Published: 2024-07-16T09:15:02.257
Modified: 2026-04-08T19:20:54.690
Link: CVE-2024-1937
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses