CVE-2026-2585: Brizy Page Builder WordPress XSS Vulnerability

CVE-2026-2585 Overview

CVE-2026-2585 is a Stored Cross-Site Scripting (XSS) vulnerability in the Brizy – Page Builder plugin for WordPress. The flaw affects all versions up to and including 2.8.14 and stems from insufficient input sanitization and output escaping on the rootAttributes parameter. Authenticated users with Contributor-level access or above can inject arbitrary JavaScript that executes when other users view the affected pages. The vulnerability is tracked as [CWE-79] and carries an EPSS probability of 0.261%.

Critical Impact
Authenticated attackers with Contributor privileges can persist malicious JavaScript in WordPress pages, enabling session theft, administrative account takeover, and site defacement when a privileged user views the injected content.

Affected Products

Brizy – Page Builder plugin for WordPress
All versions up to and including 2.8.14
WordPress sites permitting Contributor-level or higher registration

Discovery Timeline

2026-09-18 - CVE-2026-2585 published to NVD
2026-09-19 - Last updated in NVD database

Technical Details for CVE-2026-2585

Vulnerability Analysis

The Brizy page builder accepts a rootAttributes parameter when saving page block content. The plugin fails to sanitize input written into this parameter and does not escape it on output when the page is rendered. An authenticated attacker submits crafted attribute values containing HTML event handlers or <script> payloads. When any visitor or authenticated user loads the page, the browser parses the malicious markup and executes the attacker's JavaScript in the site's origin.

Because the payload persists in the database, every subsequent view triggers execution. The Scope Changed indicator in the CVSS vector reflects that scripts running in the browser reach beyond the vulnerable component into the user's authenticated WordPress session.

Root Cause

The root cause is missing input validation and missing output escaping around the rootAttributes parameter processed by the Brizy editor's save handlers. The plugin trusts values submitted by any user with the edit_posts capability, which Contributors possess by default. Neither wp_kses filtering nor esc_attr output escaping is applied before the attributes are rendered inside HTML element tags.

Attack Vector

Exploitation requires network access to the WordPress site and authenticated access at Contributor role or higher. The attacker creates or edits a draft page using the Brizy editor and injects JavaScript through the rootAttributes field via the plugin's REST or AJAX save endpoint. After submission, any user who previews, edits, or publishes the page executes the payload. Administrators reviewing the draft are the highest-value targets, since payload execution in their session enables account creation, plugin installation, or persistence via arbitrary PHP.

See the Wordfence Vulnerability Analysis for additional context.

Detection Methods for CVE-2026-2585

Indicators of Compromise

Draft or published pages containing unexpected <script> tags, on* event handlers, or javascript: URIs inside Brizy block attributes
New administrator accounts, unexpected plugin installations, or modified wp_options entries following Contributor activity
Outbound requests from admin browser sessions to unfamiliar domains shortly after loading a Brizy-authored page

Detection Strategies

Query the wp_postmeta table for Brizy metadata rows containing <script, onerror=, or onload= substrings
Review WordPress audit logs for post edits from Contributor accounts that touch Brizy content, particularly newly registered users
Inspect saved page HTML for attribute values that decode to executable JavaScript within Brizy-rendered blocks

Monitoring Recommendations

Enable file integrity monitoring on the WordPress plugins and uploads directories to catch post-exploitation payload drops
Forward WordPress and web server logs to a SIEM and alert on Contributor-role edits followed by administrator page previews
Track the plugin version reported by WordPress and alert when any site runs Brizy 2.8.14 or earlier

How to Mitigate CVE-2026-2585

Immediate Actions Required

Update the Brizy – Page Builder plugin to the version released after changeset 3565838 on all WordPress sites
Audit Contributor, Author, and Editor accounts and remove any that are unrecognized or dormant
Review all pages created or edited by non-administrator accounts for injected scripts before publishing

Patch Information

The vendor addressed the vulnerability in the plugin update tracked by WordPress Changeset 3565838. The fix adds sanitization and output escaping to the rootAttributes handling path. Site operators should install the fixed release via the WordPress plugin updater and confirm the new version is active on every site in the estate.

Workarounds

Disable the Brizy plugin on sites that cannot be updated immediately
Restrict Contributor and Author account creation and require administrator approval for new registrations
Deploy a Web Application Firewall rule that blocks HTML event handlers and <script> tags in Brizy save requests

bash

# Update Brizy via WP-CLI on affected hosts
wp plugin update brizy --all-hosts
wp plugin get brizy --field=version

# Search database for likely stored XSS payloads in Brizy metadata
wp db query "SELECT post_id, meta_key FROM wp_postmeta \
  WHERE meta_key LIKE 'brizy%' \
  AND (meta_value LIKE '%<script%' OR meta_value LIKE '%onerror=%' OR meta_value LIKE '%onload=%');"