← Back

Brizy

brizy

Vendor: Brizy • 26 CVEs

CVEs (26)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2024-1165
1Brizy
1Brizy
Apr 8, 2026
Feb 26, 2024
N/A· v4
6.5 MEDIUM· v3
N/A· v2
The Brizy – Page Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.4.39 via the 'id'. This makes it possible for authenticated attackers, with contributor-level acc...Show more
The Brizy – Page Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.4.39 via the 'id'. This makes it possible for authenticated attackers, with contributor-level access and above, to upload files to arbitrary locations on the serverShow less
CVE-2023-51396
1Brizy
1Brizy
Apr 28, 2026
Dec 29, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brizy.Io Brizy – Page Builder allows Stored XSS.This issue affects Brizy – Page Builder: from n/a through 2.4.29.
CVE-2020-36714
1Brizy
1Brizy
Apr 8, 2026
Oct 20, 2023
N/A· v4
8.1 HIGH· v3
N/A· v2
The Brizy plugin for WordPress is vulnerable to authorization bypass due to a incorrect capability check on the is_administrator() function in versions up to, and including, 1.0.125. This makes it possible for authentica...Show more
The Brizy plugin for WordPress is vulnerable to authorization bypass due to a incorrect capability check on the is_administrator() function in versions up to, and including, 1.0.125. This makes it possible for authenticated attackers to access and interact with available AJAX functions.Show less
CVE-2023-2897
1Brizy
1Brizy
Apr 8, 2026
Jun 9, 2023
N/A· v4
5.3 MEDIUM· v3
N/A· v2
The Brizy Page Builder plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.4.18. This is due to an implicit trust of user-supplied IP addresses in an 'X-Forwarded-For' HTTP heade...Show more
The Brizy Page Builder plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.4.18. This is due to an implicit trust of user-supplied IP addresses in an 'X-Forwarded-For' HTTP header for the purpose of validating allowed IP addresses against a Maintenance Mode whitelist. Supplying a whitelisted IP address within the 'X-Forwarded-For' header allows maintenance mode to be bypassed and may result in the disclosure of potentially sensitive information or allow access to restricted functionality.Show less
CVE-2022-2041
1Brizy
1Brizy
Jan 16, 2025
Jun 27, 2022
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
The Brizy WordPress plugin before 2.4.2 does not sanitise and escape some element content, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks
CVE-2022-2040
1Brizy
1Brizy
Jan 16, 2025
Jun 27, 2022
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
The Brizy WordPress plugin before 2.4.2 does not sanitise and escape some element URL, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks