The vulnerability allows an attacker to inject unsanitized JavaScript into webpages served by a WordPress site that uses the Brizy plugin. The CVE data does not explicitly state that an attacker must supply or manipulate plugin content, but it is inferred that malicious input through the plugin’s input mechanisms or manipulated request parameters would be required for exploitation. This can enable phishing, credential theft, or defacement if control over script insertion is achieved.

Affected products are the Brizy page builder plugin from themefuse.com, version 2.7.7 and all earlier releases. The vulnerability exists in both the free WordPress distribution and the premium edition of the plugin. WordPress sites that have installed these or earlier releases are vulnerable unless upgraded.

Risk is moderate with a CVSS score of 6.5. The EPSS score is below 1 %, indicating that exploitation is considered uncommon at present, and the vulnerability is not listed in CISA KEV. The CVE does not explicitly state that exploitation requires the ability to supply or modify content within the plugin, but it is inferred that such capabilities might be necessary and may be limited to users with editing or administrative rights. Based on the description, it is inferred that there is no remote unilateral exploitation vector, which would limit immediate impact; however, if malicious scripts are injected, widespread user compromise could occur.