Brizy – Page Builder, CVE-2021-38344
- CVE, Research URL
- Home page URL
- Application
- Published on
- Oct 14, 2021
- Research Description
- The Brizy Page Builder plugin <= 2.3.11 for WordPress was vulnerable to stored XSS by lower-privileged users such as a subscribers. It was possible to add malicious JavaScript to a page by modifying the request sent to update the page via the brizy_update_item AJAX action and adding JavaScript to the data parameter, which would be executed in the session of any visitor viewing or previewing the post or page.
- Affected versions
-
max 2.3.12.
- Status
-
vulnerable