CVE-2026-16069CWE-79cross-site-scripting

CVE-2026-16069

Medium · published August 4, 2026

CVSS v3.1
6.8
EPSS
0%
Percentile
36.3
In the wild
Unconfirmed
What it is

The Brizy WordPress plugin before 2.8.19 does not sanitize or escape featured-image focal-point coordinates submitted through one of its AJAX actions before storing them and later echoing them into HTML attributes in the post editor's Featured Image meta box, allowing users with the Contributor role or above to inject arbitrary web scripts that execute in the session of a higher-privileged user who opens the post for review.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00431 · 36.3th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-08-04T11:16Z
References (1)
https://wpscan.com/vulnerability/3fce478e-e240-46f4-b4a5-682eec11c7ad/ · [email protected]
EPSS history
Timeline
  • 04 AUG 06:00Z
    Brizy - Page Builder < 2.8.19 - Contributor+ Stored XSS via Featured Image Focal Point
    cvelistv5