The Brizy – Page Builder plugin for WordPress allows stored cross‑site scripting through the 'brizy-compiled-sections' post meta field. A contributor‑level or higher authenticated user can inject malicious scripts that are served when any visitor loads the affected page, potentially hijacking sessions, defacing content, or delivering phishing payloads. The vulnerability arises from insufficient input sanitization and lack of output escaping in all versions up to 2.8.18.

WordPress sites that use the Brizy – Page Builder plugin, specifically all releases up to and including version 2.8.18. The plugin is supplied by themefusecom and is identified as Brizy – Page Builder.

The CVSS score of 6.4 classifies the issue as moderate risk. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating limited known exploitation. Because the attack requires authenticated contributor or higher privileges, an attacker must first acquire or abuse valid credentials. Once achieved, the malicious script will execute in the browser context of any user who views the compromised page, leading to defacement, credential theft or other XSS‑based attacks.