CVE-2026-16069

Name of the Vulnerable Software and Affected Versions Brizy WordPress plugin versions prior to 2.8.19

Description Insufficient sanitization and escaping of featured-image focal-point coordinates submitted via an AJAX action allows users with the Contributor role or higher to perform a Stored Cross-Site Scripting (XSS) attack. The malicious scripts are stored and subsequently executed in the session of a higher-privileged user when they open the post for review within the Featured Image meta box of the post editor.

Recommendations Update the Brizy WordPress plugin to version 2.8.19 or later.