Descrição
The Brizy WordPress plugin before 2.8.19 does not sanitize or escape featured-image focal-point coordinates submitted through one of its AJAX actions before storing them and later echoing them into HTML attributes in the post editor-s Featured Image meta box, allowing users with the Contributor role or above to inject arbitrary web scripts that execute in the session of a higher-privileged user who opens the post for review.
CVSS 6.8EPSS 0.23500000000000001%Risco 0.69
Ver fonte- Publicação
- 2026-08-04 07:16:29
- Última alteração
- 2026-08-04 15:16:25
- Vetor
- CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H