CVE-2026-16068

Name of the Vulnerable Software and Affected Versions Brizy WordPress plugin versions prior to 2.8.19

Description Authenticated users with Author-level access and above can store arbitrary JavaScript because the plugin does not properly restrict modifications to site-global design data and fails to sanitize this data before outputting it. This leads to a stored Cross-Site Scripting (XSS) issue—where malicious scripts are permanently stored on the server—which then executes in the browser of every visitor, including administrators, via the brizy set project Global Project Code Asset.

Recommendations Update the plugin to version 2.8.19 or later.