CVE-2026-111844: Brizy WordPress Plugin Stored XSS Vulnerability

CVE-2026-111844 Overview

CVE-2026-111844 is a stored Cross-Site Scripting (XSS) vulnerability affecting the Brizy page builder plugin for WordPress. The flaw stems from improper neutralization of user input during web page generation [CWE-79]. An authenticated attacker with low privileges can inject malicious scripts that execute in the browsers of other site users, including administrators. The vulnerability affects Brizy version 2.8.23 and requires user interaction to trigger payload execution.

Critical Impact
Authenticated attackers can store malicious JavaScript payloads that execute in victim browsers, enabling session theft, administrative account takeover, and site defacement with scope-changing consequences across the affected WordPress environment.

Affected Products

Brizy WordPress Plugin version 2.8.23
WordPress sites running the vulnerable Brizy page builder
Multisite WordPress installations with Brizy enabled

Discovery Timeline

2026-10-20 - CVE CVE-2026-111844 published to NVD
2026-10-20 - Last updated in NVD database

Technical Details for CVE-2026-111844

Vulnerability Analysis

The Brizy plugin fails to sanitize and encode user-supplied input before rendering it within generated web pages. When a contributor-level or higher user submits crafted content through the page builder interface, the plugin stores the raw payload in the WordPress database. The payload later executes in the browser of any user who views the affected page or administrative view. Because the attack scope changes between the vulnerable component and the executing browser context, the impact extends beyond the attacker's own privilege boundary.

Root Cause

The root cause is improper output encoding and insufficient input validation on content fields handled by the Brizy page builder. The plugin trusts input from authenticated low-privilege users without applying WordPress sanitization functions such as wp_kses() or escaping helpers like esc_html() and esc_attr() prior to rendering.

Attack Vector

Exploitation requires an authenticated account with permission to create or edit content through Brizy. The attacker injects a JavaScript payload into a vulnerable input field. The stored payload executes when a victim, typically a higher-privileged user such as an administrator, loads the affected page. Successful exploitation can lead to session hijacking, forced administrative actions, or injection of persistent backdoors into the site.

For technical specifics, refer to the Patchstack Brizy XSS Vulnerability Advisory.

Detection Methods for CVE-2026-111844

Indicators of Compromise

Unexpected <script> tags, onerror attributes, or JavaScript event handlers stored within Brizy post content or metadata.
New or modified WordPress administrator accounts created shortly after a contributor-level user edited Brizy content.
Outbound HTTP requests from administrator browser sessions to unfamiliar third-party domains after loading Brizy pages.

Detection Strategies

Audit the wp_posts and Brizy-specific database tables for HTML tags and JavaScript patterns within fields that should contain plain text.
Review web server access logs for POST requests to Brizy editor endpoints from low-privileged user accounts.
Deploy a web application firewall rule set that inspects WordPress REST API and admin-ajax requests for XSS payload signatures.

Monitoring Recommendations

Enable WordPress audit logging to track content changes made by contributor and author roles.
Monitor administrator session activity for anomalous actions following page views containing Brizy-rendered content.
Alert on creation of new privileged users, plugin installations, or theme file modifications outside maintenance windows.

How to Mitigate CVE-2026-111844

Immediate Actions Required

Update the Brizy plugin to a version later than 2.8.23 that addresses the stored XSS vulnerability.
Review all existing Brizy page content for previously injected scripts and remove any unauthorized payloads.
Audit WordPress user accounts and revoke contributor or author access that is not strictly necessary.

Patch Information

Users should upgrade Brizy beyond version 2.8.23 according to the Patchstack Brizy XSS Vulnerability Advisory. Verify the installed version through the WordPress plugin management interface after applying the update.

Workarounds

Temporarily disable the Brizy plugin on production sites until the patched version is deployed.
Restrict Brizy editing capabilities to trusted administrator accounts by adjusting user role permissions.
Deploy a web application firewall with WordPress-specific rules to filter inbound XSS payloads targeting the plugin.

bash

# Configuration example: enforce Content-Security-Policy header via .htaccess
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self';"
Header set X-XSS-Protection "1; mode=block"
Header set X-Content-Type-Options "nosniff"