What the vulnerability does
01Description
The Brizy – Page Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.1. This is due to missing or incorrect nonce validation on form submissions. This makes it possible for unauthenticated attackers to submit forms intended for public use as another user via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. On sites where unfiltered_html is enabled, this can lead to the admin unknowingly adding a Stored Cross-Site Scripting payload.
Explanation of Vulnerability in Simple Terms
02Summary
Brizy Page Builder versions up to 2.5.1 contain an input validation flaw that allows attackers to modify page content through a crafted request. The vulnerability requires user interaction—typically clicking a malicious link—and affects only data integrity, not confidentiality or availability. Site owners should update to a version newer than 2.5.1 when available.
What an attacker can do
03Attacker Capabilities
Modify page content or data on the site if a user clicks a malicious link.
Potential impact on your site
04Site Impact
Page content could be altered without authorization if users are socially engineered.
Conditions required to exploit
05Prerequisites
Attacker must trick a user into clicking a link; no authentication required.
Key dates
06Disclosure timeline
August 8, 2024
CVE published
April 8, 2026
Record updated
