CVE-2026-16069: Brizy WordPress Plugin XSS Vulnerability

CVE-2026-16069 Overview

CVE-2026-16069 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Brizy WordPress plugin before version 2.8.19. The plugin fails to sanitize or escape featured-image focal-point coordinates submitted through one of its AJAX actions. It stores the untrusted values and later echoes them into HTML attributes inside the post editor's Featured Image meta box. Contributor-level users can inject arbitrary JavaScript that executes when a higher-privileged user opens the post for review.

Critical Impact
Authenticated Contributors can execute JavaScript in an Editor or Administrator browser session, enabling account takeover of privileged WordPress users.

Affected Products

Brizy WordPress plugin versions before 2.8.19

Discovery Timeline

2026-08-04 - CVE-2026-16069 published to the National Vulnerability Database
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-16069

Vulnerability Analysis

The Brizy plugin accepts focal-point coordinates for featured images through an AJAX endpoint. These coordinates are user-controlled numeric values used to position the image crop focus. The plugin persists the submitted data without sanitization and later renders it directly into HTML attributes in the Featured Image meta box inside the WordPress post editor.

Because the values are echoed into an attribute context without escaping, an attacker can break out of the attribute and inject event handlers or additional markup. Any Editor or Administrator who opens the affected post for review triggers execution of the payload in their authenticated session. This exposure enables session theft, forced administrative actions through the REST API, or plugin and theme modification leading to full site compromise.

Root Cause

The plugin fails to apply WordPress escaping routines such as esc_attr() on focal-point coordinate data before storage and output. Input validation is also missing at the AJAX handler, so non-numeric strings containing HTML metacharacters are accepted and preserved verbatim.

Attack Vector

Exploitation requires an authenticated account with the Contributor role or higher. The attacker submits a crafted AJAX request containing a malicious focal-point value against a post they own. The payload lies dormant until an Editor or Administrator opens the post for review, at which point the injected script executes with that user's privileges. User interaction from the privileged victim is required, which is reflected in the vulnerability's attack requirements.

See the WPScan Vulnerability Report for additional technical detail.

Detection Methods for CVE-2026-16069

Indicators of Compromise

Focal-point coordinate values in post metadata containing HTML characters such as <, >, ", or on event handler prefixes rather than numeric strings.
AJAX POST requests to Brizy plugin endpoints from Contributor accounts containing script tokens like <script, javascript:, or onerror= in payload parameters.
Unexpected outbound requests from an Administrator browser session immediately after opening a Contributor-authored post for review.

Detection Strategies

Query the wp_postmeta table for Brizy focal-point keys and flag any value that does not match a strict numeric or decimal pattern.
Inspect web server access logs for admin-ajax.php requests targeting Brizy actions where request bodies contain HTML metacharacters.
Correlate low-privilege user post edits with subsequent privileged user post views to identify potential exploitation chains.

Monitoring Recommendations

Enable WordPress audit logging to capture post metadata changes made by Contributor and Author accounts.
Monitor administrator account activity for unexpected user creation, plugin installation, or option changes following post review sessions.
Alert on Content Security Policy violation reports originating from /wp-admin/post.php pages.

How to Mitigate CVE-2026-16069

Immediate Actions Required

Update the Brizy plugin to version 2.8.19 or later on all WordPress installations.
Audit existing posts authored by Contributor and Author accounts for suspicious focal-point metadata before privileged users open them.
Review Administrator and Editor accounts for signs of compromise, including new users, changed passwords, and unexpected plugin installations.

Patch Information

Brizy addressed the issue in version 2.8.19 by sanitizing and escaping focal-point coordinate values at input and output. Site operators should apply the update through the WordPress plugin manager or WP-CLI.

Workarounds

Restrict Contributor role assignments and require editorial workflows that vet content before opening posts in the editor.
Deactivate the Brizy plugin until the update to 2.8.19 can be applied if immediate patching is not possible.
Deploy a web application firewall rule that rejects admin-ajax.php requests to Brizy actions containing HTML metacharacters in coordinate fields.

bash

# Update Brizy to the patched release using WP-CLI
wp plugin update brizy --version=2.8.19

# Verify installed version
wp plugin get brizy --field=version