The Brizy – Page Builder plugin for WordPress contains a flaw that allows unauthenticated users to store malicious script code in the FileUpload field of form entries. Because the plugin removes nonce verification for form submissions that are not logged in, fails to overwrite user supplied values when no file is present, and then reverses HTML entity encoding with html_entity_decode() before rendering the value in an admin link, an attacker can plant arbitrary JavaScript. When an administrator later navigates to the form Leads page the script executes in the admin context, potentially leading to credential theft, defacement, or further attacks. This vulnerability is a classic case of stored cross‑site scripting (CWE‑79).

The vulnerable product is the WordPress plugin Brizy – Page Builder, versions up to and including 2.8.11. The plugin can be installed on any WordPress site that uses these versions, regardless of the underlying operating system or WordPress version.

The CVSS base score of 7.2 designates this flaw as a high‑severity stored XSS. With no authentication required, the attack vector is remote via standard HTTP requests to the form submission endpoint. Because the EPSS score is not available and the vulnerability is not listed in the CISA KEV database, there is no current evidence of exploitation in the wild, but the lack of security controls makes it straightforward for an attacker to craft a malicious post and force a site administrator to load a page that runs the payload. Consequently, the risk to any WordPress site that has this plugin installed is significant, especially if administrative users are logged in or the site is exposed to the internet.