VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

Brizy – Page Builder security & vulnerabilities

brizy— active installsLast vulnerability Oct 20, 2026

No known unpatched vulnerabilities in the latest version

All 38 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin
38Known vulnerabilities
  • Critical1
  • High10
  • Medium26
  • Low1
Vulnerabilities per year
2020: 3 vulnerabilities3202021: 2 vulnerabilities2212022: 2 vulnerabilities2222023: 2 vulnerabilities2232024: 14 vulnerabilities14242025: 6 vulnerabilities6252026: 9 vulnerabilities926

All Brizy – Page Builder vulnerabilities

Brizy – Page Builder vulnerabilities
SeverityVulnerabilityCVEPublished
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
2.8.23 – 2.8.23Update to 2.8.24
CVE-2026-111844
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'brizy-compiled-sections' Post Meta
≤2.8.18Update to 2.8.19
CVE-2026-14882
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'rootAttributes' Parameter
≤2.8.14Update to 2.8.15
CVE-2026-2585
Medium4.3Authenticated (Contributor+) Information Exposure
<2.8.18Update to 2.8.18
CVE-2026-14195
Medium6.4Page Builder <= 2.8.18 - Authenticated (Author+) Stored Cross-Site Scripting
≤2.8.18Update to 2.8.19
CVE-2026-16068
Medium4.3Page Builder <= 2.8.18 - Insecure Direct Object Reference to Authenticated (Contributor+) Template Type Update
≤2.8.18Update to 2.8.19
CVE-2026-16070
Medium6.4Page Builder <= 2.8.18 - Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.8.18Update to 2.8.19
CVE-2026-16069
High7.2Unauthenticated Stored Cross-Site Scripting via FileUpload Field Value
≤2.8.11Update to 2.8.12
CVE-2026-5324
Medium4.3Missing Authorization
≤2.7.23Update to 2.7.24
CVE-2026-32408
Medium6.5Authenticated (Contributor+) Sensitive Information Exposure via get_users Function
≤2.7.16Update to 2.7.17
CVE-2025-0969
Medium4.3Missing Authorization
≤2.7.12Update to 2.7.13
CVE-2025-58594
Medium5.3Missing Authorization to Unauthenticated Limited File Upload
≤2.6.20Update to 2.6.21
CVE-2025-4370
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.7.7Update to 2.7.8
CVE-2025-32198
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
≤2.6.8Update to 2.6.9
CVE-2024-10322
Critical9.9Authenticated (Contributor+) Arbitrary File Upload via storeUploads
≤2.6.4Update to 2.6.5
CVE-2024-10960
Medium4.3Cross-Site Request Forgery
≤2.5.1Update to 2.5.2
CVE-2024-6254
High8.8Authenticated (Contributor+) Arbitrary File Upload
≤2.4.44Update to 2.4.45
CVE-2024-3242
High7.1Missing Authorization to Authenticated (Contributor+) Post Modification
≤2.4.44Update to 2.4.45
CVE-2024-1937
Medium6.4Authenticated(Contributor+) Stored Cross-Site Scripting via Form Functionality
≤2.4.43Update to 2.4.44
CVE-2024-1164
High7.2Unauthenticated Stored Cross-Site Scripting via Form
≤2.4.43Update to 2.4.44
CVE-2024-2087
High7.4Authenticated (Contributor+) Store Cross-Site Scripting via Widget Link To URL
≤2.4.43Update to 2.4.44
CVE-2024-3667
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Attributes
≤2.4.43Update to 2.4.44
CVE-2024-1161
Medium4.3Missing Authorization
≤2.4.43Update to 2.4.44
CVE-2024-3711
High7.1Authenticated(Contributor+) Stored Cross-Site Scripting
≤2.4.41Update to 2.4.42
CVE-2024-1940
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.4.40Update to 2.4.41
CVE-2024-1293
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.4.40Update to 2.4.41
CVE-2024-1296
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.4.40Update to 2.4.41
CVE-2024-1291
Medium4.3Authenticated (Contributor+) Directory Traversal
≤2.4.40Update to 2.4.41
CVE-2024-1165
High8.8Authenticated (Contributor+) Arbitrary File Upload
≤2.4.40Update to 2.4.41
CVE-2024-1311
Medium6.4Cross-Site Scripting
≤2.4.29Update to 2.4.30
CVE-2023-51396
Low3.7IP Address Spoofing to Protection Mechanism Bypass
≤2.4.18Update to 2.4.19
CVE-2023-2897
Medium5.4Authenticated Stored Cross-Site Scripting via Element URL
<2.4.2Update to 2.4.2
CVE-2022-2040
Medium5.4Authenticated Stored Cross-Site Scripting via Element Content
<2.4.2Update to 2.4.2
CVE-2022-2041
High8.8Authenticated File Upload and Path Traversal
≤2.3.11Update to 2.3.12
CVE-2021-38346
Medium6.4Page Builder <= 2.3.11 - Stored Cross-Site Scripting
≤2.3.11Update to 2.3.12
CVE-2021-38344
High7.1Incorrect Authorization Checks Allowing Post Modification
≤2.3.11Update to 1.0.126 or 2.3.12
CVE-2021-38345
High7.4Authorization Bypass to Settings Updates
<1.0.126Update to 1.0.126
CVE-2020-36714
Medium6.5Page Builder < 1.0.114 - Missing Authorization to Settings Update
<1.0.114Update to 1.0.114
—

Brizy – Page Builder: common questions

Does Brizy – Page Builder have known vulnerabilities?

Yes. VulnCrest Radar lists 38 known vulnerabilities in Brizy – Page Builder: 1 critical, 10 high, 26 medium, 1 low. None are known to affect version null.

How do I check which version of Brizy – Page Builder I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent Brizy – Page Builder vulnerability?

CVE-2026-111844, published Oct 20, 2026: Brizy – Page Builder 2.8.23 - Authenticated (Contributor+) Stored Cross-Site Scripting. Severity: Medium (CVSS 6.4).

Is any Brizy – Page Builder vulnerability listed in CISA KEV?

No. None of the known Brizy – Page Builder vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?