CVE-2026-14882 Overview
The Brizy – Page Builder plugin for WordPress contains a stored Cross-Site Scripting (XSS) vulnerability affecting all versions up to and including 2.8.18. The flaw resides in the brizy-compiled-sections parameter, which lacks sufficient input sanitization and output escaping. Authenticated users with contributor-level access or higher can inject arbitrary JavaScript into pages. The injected scripts execute in the browser of any user who views an affected page. This vulnerability is tracked under CWE-79 and carries a Scope:Changed indicator, meaning the impact can extend beyond the vulnerable component.
Critical Impact
Authenticated contributors can plant persistent JavaScript payloads that execute against administrators and site visitors, enabling session theft, credential harvesting, and administrative action hijacking.
Affected Products
- Brizy – Page Builder plugin for WordPress, all versions up to and including 2.8.18
- WordPress sites allowing contributor-level accounts or higher
- Any site exposing the brizy-compiled-sections parameter to authenticated users
Discovery Timeline
- 2026-10-10 - CVE-2026-14882 published to NVD
- 2026-10-13 - Last updated in NVD database
Technical Details for CVE-2026-14882
Vulnerability Analysis
The vulnerability is a stored XSS flaw in the Brizy page builder's handling of compiled section content. When an authenticated contributor submits data through the brizy-compiled-sections parameter, the plugin stores the payload without proper sanitization. On page render, the stored content is emitted into the HTML response without adequate output escaping. Any script tags or JavaScript event handlers in the stored payload execute in the viewer's browser session.
The Scope:Changed classification reflects that the executed script runs in the context of the WordPress site origin, allowing the attacker to act against other users and administrative interfaces. Successful exploitation can lead to session hijacking, cookie theft, forced administrative actions through CSRF-like chaining, and defacement of published content.
Root Cause
The root cause is a dual failure: missing input sanitization on write and missing output escaping on render. The plugin treats contributor-supplied section markup as trusted structured content rather than untrusted input requiring sanitization through WordPress APIs such as wp_kses_post() or context-aware escapers like esc_html() and esc_attr().
Attack Vector
An authenticated attacker with at least contributor privileges crafts a page using the Brizy builder and injects a malicious payload through the brizy-compiled-sections parameter. The payload is persisted in the WordPress database alongside legitimate page content. When an administrator, editor, or site visitor loads the page, the browser parses the injected script and executes it in the site's origin context. No user interaction beyond page navigation is required for exploitation. Refer to the Wordfence Vulnerability Report for additional technical analysis.
Detection Methods for CVE-2026-14882
Indicators of Compromise
- Pages or posts containing <script> tags, inline event handlers, or javascript: URIs within Brizy-managed sections
- Unexpected contributor-authored pages containing obfuscated JavaScript, base64 blobs, or references to external attacker-controlled domains
- WordPress admin sessions terminating or privileges changing shortly after an administrator previews a contributor-authored page
- Outbound requests from administrator browsers to unknown domains originating from Brizy-rendered pages
Detection Strategies
- Review database records in wp_postmeta for Brizy keys and inspect stored brizy-compiled-sections values for script content
- Audit all contributor and author accounts for recent page creations or edits involving Brizy sections
- Scan rendered HTML output of Brizy pages with headless browser tooling to detect script execution not present in the published template
Monitoring Recommendations
- Enable WordPress audit logging to track post edits performed by non-administrator roles
- Monitor web server logs for POST requests to Brizy editor endpoints referencing the brizy-compiled-sections parameter
- Configure a Content Security Policy (CSP) that reports violations when inline scripts execute on content pages
How to Mitigate CVE-2026-14882
Immediate Actions Required
- Update the Brizy – Page Builder plugin to a version newer than 2.8.18 that includes the fix referenced in the WordPress Brizy Changeset
- Audit existing pages created or modified by contributor-level accounts and remove any embedded scripts
- Review and tighten role assignments so that only trusted users hold contributor privileges or higher
Patch Information
The maintainers released a fix in changeset 3619520, which adds proper sanitization and escaping for the brizy-compiled-sections parameter. Site operators should upgrade through the WordPress plugin updater or by replacing the plugin directory with the patched release. Verify installed versions site-wide after update.
Workarounds
- Temporarily restrict contributor and author roles from using the Brizy builder until patching is complete
- Deploy a Web Application Firewall (WAF) rule that blocks script tags and JavaScript event handlers in the brizy-compiled-sections parameter
- Enforce a strict Content Security Policy that disallows inline scripts on front-end pages to limit payload execution
- Require administrator review and approval before publishing any page authored by lower-privileged users
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
