{"id":"CVE-2026-111844","kind":"vulnerability","aliases":["CVE-2026-111844"],"related":[],"title":"Brizy page builder: stored XSS via unsanitized input in version 2.8.23","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brizy Brizy brizy allows Stored XSS.This issue affects Brizy: 2.8.23.","summary":"Brizy, a WordPress page builder plugin, fails to neutralize input when generating web pages, enabling stored cross-site scripting. An attacker who can submit content that gets saved and rendered can run JavaScript in other users' browsers.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["brizy","package","self-hosted","wordpress"],"not_affected_if":["other-version"],"how_to_check":"- Check the installed Brizy version in the WordPress plugins screen or the plugin's main file header and see whether it is `2.8.23`.\n- unknown for further steps; the sources do not name the affected input field or page type.","fix":"- Update Brizy to a version newer than `2.8.23`; the sources do not name the patched release.\n- unknown for other mitigations; the sources do not say.","status":"open","published_at":"2026-10-20T10:17:01+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T03:55:40+00:00","updated_at":"2026-10-25T03:55:40+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T03:55:40Z","model":"claude-haiku-5-5","output":{"fix":"- Update Brizy to a version newer than `2.8.23`; the sources do not name the patched release.\n- unknown for other mitigations; the sources do not say.","reach":"internet","title":"Brizy page builder: stored XSS via unsanitized input in version 2.8.23","impact":"medium","summary":"Brizy, a WordPress page builder plugin, fails to neutralize input when generating web pages, enabling stored cross-site scripting. An attacker who can submit content that gets saved and rendered can run JavaScript in other users' browsers.","category":"package","nicknames":[],"who_cares":["wordpress","brizy","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker script runs in other users' browsers on the site.","analyst_note":"Check the NVD entry and Brizy's changelog for the patched version, the vulnerable input field, and the required privilege level.","how_to_check":"- Check the installed Brizy version in the WordPress plugins screen or the plugin's main file header and see whether it is `2.8.23`.\n- unknown for further steps; the sources do not name the affected input field or page type.","needs_analyst":true,"not_affected_if":["other-version"],"who_is_affected":"Sites running Brizy version 2.8.23 are listed as affected. Exposure depends on which users can submit content that Brizy stores and renders, which the sources do not describe. Sites on other Brizy versions are not named in this entry.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000602,"input_tokens":3300,"output_tokens":544,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111844':14A,17A '-2026':13A,16A '2.8.23':11A,85C 'affect':83C 'allow':79C 'attack':45B 'brizi':1A,18B,24B,76C,77C,78C,84C 'browser':61B 'builder':3A,28B 'content':49B 'cross':41B,71C 'cross-sit':40B,70C 'cve':12A,15A 'enabl':38B 'fail':30B 'generat':35B,69C 'get':51B 'host':22B 'improp':62C 'input':8A,33B,65C 'issu':82C 'javascript':57B 'neutral':32B,63C 'packag':19B 'page':2A,27B,37B,68C 'plugin':29B 'render':54B 'run':56B 'save':52B 'script':43B,73C 'self':21B 'self-host':20B 'site':42B,72C 'store':4A,39B,80C 'submit':48B 'unsanit':7A 'user':60B 'version':10A 'via':6A 'vulner':74C 'web':36B,67C 'wordpress':23B,26B 'xss':5A 'xss.this':81C","nicknames":[],"mitigations":[],"who_affected":"Sites running Brizy version 2.8.23 are listed as affected. Exposure depends on which users can submit content that Brizy stores and renders, which the sources do not describe. Sites on other Brizy versions are not named in this entry.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T10:17:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111844","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111844","severity":null,"published_at":"2026-10-20T10:17:01+00:00","modified_at":"2026-10-20T19:27:34+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}