The Brizy plugin for WordPress contains a stored cross‑site scripting flaw caused by improper neutralization of user‑supplied input during web page rendering. When content is created or edited, the plugin stores the raw input and later displays it on public pages without adequate escaping, allowing an attacker to inject arbitrary scripts that will be executed in the browsers of site visitors. The vulnerability is a classic stored XSS, as classified by CWE‑79. The impact is that attackers can hijack user sessions, deface the website, intercept credentials, or redirect users to malicious sites as long as the injected payload is rendered in a trusted context.

This issue affects WordPress sites that have the Brizy plugin installed, specifically version 2.8.23. The vulnerability resides in the Brizy "Brizy" product, which is a page builder plugin used by site administrators and content creators. Only sites running this particular version are at risk; newer releases include the fix.

The CVSS score of 6.5 indicates a moderate severity, but the EPSS score of less than 1% suggests that the likelihood of exploitation at this time is very low. The vulnerability is not listed in the CISA KEV catalog, implying it has not yet been widely exploited in known campaigns. Attackers would need to supply malicious content through the plugin’s interface—typically accessible to users with content creation rights—and rely on the fact that the site displays that content to visitors. Because the exploit relies on user interaction with the plugin, it may be limited to platforms where the user base includes individuals capable of creating or editing pages. Overall the risk is moderate with low exploitation probability under current conditions.