Improper neutralization of input during web page generation in the Brizy Pro plugin leads to a reflected XSS flaw that allows an attacker to inject and execute arbitrary script within a victim’s browser when the victim accesses a specially crafted request generated by the plugin. The weakness is identified as CWE‑79, a type of input validation bypass.

The vulnerability affects the Brizy Pro WordPress plugin versions from the earliest release up to and including 2.6.1. All installations of this plugin using those versions are potentially vulnerable, regardless of the WordPress core version.

The CVSS score of 7.1 reflects a moderate‑to‑high potential for exploitation. The EPSS score of less than 1% indicates a low current likelihood of exploitation. The vulnerability is not listed in CISA KEV. Based on the description, the likely attack vector involves a victim visiting a maliciously constructed URL or submitting a crafted form that triggers the plugin’s page generation, causing the embedded script to run. No elevated privileges or remote code execution beyond the victim’s browser context is indicated.