WordPress plugin · brizy
Is Brizy safe?
Safe on 2.8.24 or newer.
The current version, 2.8.24, is past every affected range on record (36 of 37 records list one; 1 doesn’t, so check it below). Keep it updated and you’re clear of them.
- Flaws on record
- 37
- High or critical
- 11
- Exploited
- none
- Current version
- 2.8.24
- Last updated
- Oct 19, 2026
- Active installs
- 60,000+
Every recorded flaw
- Oct 20, 2026Brizy Brizy brizy: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-111844 · reported by PatchstackMedium 6.5
- Oct 10, 2026Brizy – Page Builder: Stored Cross-Site ScriptingCVE-2026-14882 · affects up to 2.8.18 · reported by WordfenceMedium 6.4
- Sep 17, 2026Brizy – Page Builder: Stored Cross-Site ScriptingCVE-2026-2585 · affects up to 2.8.14 · reported by WordfenceMedium 6.4
- Aug 4, 2026Brizy: Does not properly verify authorization on the object being modified before updating a template's type metaCVE-2026-16070 · fixed in 2.8.19 · reported by WPScanLow 2.7
- Aug 4, 2026Brizy: Does not sanitize or escape featured-image focal-point coordinates submitted through one of its AJAX actions before storing them and later echoing them into HTML attributes in the post editor's Featured Image metaCVE-2026-16069 · fixed in 2.8.19 · reported by WPScanMedium 6.8
- Aug 4, 2026Brizy: Does not properly restrict who can modify its site-global design data and does not sanitise part of that data before outputting itCVE-2026-16068 · fixed in 2.8.19 · reported by WPScanLow 3.5
- Aug 1, 2026Brizy: Does not properly verify authorization on a request handler before returning post contentCVE-2026-14195 · fixed in 2.8.18 · reported by WPScanLow 2.7
- May 2, 2026Brizy – Page Builder: Unauthenticated Stored Cross-Site ScriptingCVE-2026-5324 · affects up to 2.8.11 · reported by WordfenceHigh 7.2
- Mar 13, 2026Brizy: Missing AuthorizationCVE-2026-32408 · affects up to 2.7.23 · reported by PatchstackMedium 4.3
- Dec 13, 2025Brizy – Page Builder: Sensitive Information ExposureCVE-2025-0969 · affects up to 2.7.16 · reported by WordfenceMedium 6.5
- Sep 3, 2025Brizy: Missing AuthorizationCVE-2025-58594 · affects up to 2.7.12 · reported by PatchstackMedium 4.3
- Jul 29, 2025Brizy – Page Builder: Limited file uploadsCVE-2025-4370 · affects up to 2.6.20 · reported by WordfenceMedium 5.3
- Apr 10, 2025Brizy: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32198 · affects up to 2.7.7 · reported by PatchstackMedium 6.5
- Feb 12, 2025Brizy – Page Builder: Stored Cross-Site ScriptingCVE-2024-10322 · affects up to 2.6.8 · reported by WordfenceMedium 6.4
- Feb 12, 2025Brizy – Page Builder: Arbitrary file uploadsCVE-2024-10960 · affects up to 2.6.4 · reported by WordfenceCritical 9.9
- Aug 8, 2024Brizy – Page Builder: Cross-Site Request ForgeryCVE-2024-6254 · affects up to 2.5.1 · reported by WordfenceMedium 4.3
- Jul 18, 2024Brizy – Page Builder: Arbitrary file uploadsCVE-2024-3242 · affects up to 2.4.43 · reported by WordfenceHigh 8.8
- Jul 16, 2024Brizy – Page Builder: Unauthorized modification of dataCVE-2024-1937 · affects up to 2.4.44 · reported by WordfenceHigh 7.1
- Jun 5, 2024Brizy – Page Builder: Stored Cross-Site ScriptingCVE-2024-1164 · affects up to 2.4.43 · reported by WordfenceMedium 6.4
- Jun 5, 2024Brizy – Page Builder: Stored Cross-Site ScriptingCVE-2024-3667 · affects up to 2.4.43 · reported by WordfenceHigh 7.4
- Jun 5, 2024Brizy – Page Builder: Stored Cross-Site ScriptingCVE-2024-2087 · affects up to 2.4.43 · reported by WordfenceHigh 7.2
- Jun 5, 2024Brizy – Page Builder: Stored Cross-Site ScriptingCVE-2024-1940 · affects up to 2.4.41 · reported by WordfenceHigh 7.1
- Jun 5, 2024Brizy – Page Builder: Stored Cross-Site ScriptingCVE-2024-1161 · affects up to 2.4.43 · reported by WordfenceMedium 6.4
- May 23, 2024Brizy – Page Builder: Unauthorized plugin setting updateCVE-2024-3711 · affects up to 2.4.43 · reported by WordfenceMedium 4.3
- Mar 13, 2024Brizy – Page Builder: Arbitrary file uploadsCVE-2024-1311 · affects up to 2.4.40 · reported by Wordfence1.5% oddsHigh 8.8
- Mar 13, 2024Brizy – Page Builder: Stored Cross-Site ScriptingCVE-2024-1296 · affects up to 2.4.40 · reported by WordfenceMedium 6.4
- Mar 13, 2024Brizy – Page Builder: Stored Cross-Site ScriptingCVE-2024-1293 · affects up to 2.4.40 · reported by WordfenceMedium 6.4
- Mar 13, 2024Brizy – Page Builder: Stored Cross-Site ScriptingCVE-2024-1291 · affects up to 2.4.40 · reported by WordfenceMedium 6.4
- Feb 26, 2024Brizy – Page Builder: Directory TraversalCVE-2024-1165 · affects up to 2.4.39 · reported by WordfenceMedium 4.3
- Dec 29, 2023Brizy – Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51396 · affects up to 2.4.29 · reported by PatchstackMedium 6.5
- Oct 20, 2023Brizy: Authorization bypassCVE-2020-36714 · affects up to 1.0.125 · reported by WordfenceHigh 7.4
- Jun 9, 2023Brizy Page Builder: IP Address SpoofingCVE-2023-2897 · affects up to 2.4.18 · reported by WordfenceLow 3.7
- Jun 27, 2022Brizy: Does not sanitise and escape some element contentCVE-2022-2041 · fixed in 2.4.2 · reported by WPScanMedium 5.4
- Jun 27, 2022Brizy: Does not sanitise and escape some element URLCVE-2022-2040 · fixed in 2.4.2 · reported by WPScanMedium 5.4
- Oct 14, 2021The Brizy Page Builder plugin <= 2.3.11 for WordPress allowed authenticated users to upload executable files to a location of their choice using the brizy_creatCVE-2021-38346 · affects up to 2.3.11 · reported by Wordfence1.7% oddsHigh 8.8
- Oct 14, 2021The Brizy Page Builder plugin <= 2.3.11 for WordPress used an incorrect authorization check that allowed any logged-in user accessing any endpoint in the wp-admCVE-2021-38345 · affects up to 2.3.11 · fixed in 1.0.126 · reported by WordfenceHigh 7.1
- Oct 14, 2021The Brizy Page Builder plugin <= 2.3.11 for WordPress was vulnerable to stored XSS by lower-privileged users such as a subscribers.CVE-2021-38344 · affects up to 2.3.11 · reported by WordfenceMedium 6.4
Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.