CVE-2025-4370 | Medium | 5.3 | 2025-07-29 | The Brizy – Page Builder plugin for WordPress is vulnerable to limited file uploads due to missing authorization on process_external_asset_urls function as wel… |
CVE-2025-32198 | Medium | 6.5 | 2025-04-10 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themefusecom Brizy brizy.This issue affects Brizy: from n… |
CVE-2025-26902 | Medium | 4.3 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in Brizy Brizy Pro allows Cross Site Request Forgery.This issue affects Brizy Pro: from n/a through 2.6.1. |
CVE-2025-26901 | Medium | 4.3 | 2025-04-09 | Missing Authorization vulnerability in Brizy Brizy Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Brizy Pro: fr… |
CVE-2024-10322 | Medium | 6.4 | 2025-02-12 | The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and including… |
CVE-2024-10960 | Critical | 9.9 | 2025-02-12 | The Brizy – Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'storeUploads' function in all… |
CVE-2025-22763 | High | 7.1 | 2025-01-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Brizy Pro allows Reflected XSS. This issue affec… |
CVE-2024-6254 | Medium | 4.3 | 2024-08-08 | The Brizy – Page Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.1. This is due to missing o… |
CVE-2024-3242 | High | 8.8 | 2024-07-18 | The Brizy – Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file extension validation in the validateImageContent func… |
CVE-2024-1937 | High | 7.1 | 2024-07-16 | The Brizy – Page Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_item' functio… |
CVE-2024-1164 | Medium | 6.4 | 2024-06-05 | The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's contact form widget error message and redirect URL… |
CVE-2024-3667 | High | 7.4 | 2024-06-05 | The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Link To' field of multiple widgets in all versions up to, a… |
CVE-2024-2087 | High | 7.2 | 2024-06-05 | The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form name values in all versions up to, and including, 2.4.4… |
CVE-2024-1940 | High | 7.1 | 2024-06-05 | The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post content in all versions up to, and including, 2.4.41 due to… |
CVE-2024-1161 | Medium | 6.4 | 2024-06-05 | The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Custom Attributes for blocks in all versions up to… |
CVE-2024-3711 | Medium | 4.3 | 2024-05-23 | The Brizy – Page Builder plugin for WordPress is vulnerable to unauthorized plugin setting update due to a missing capability check on the functions action_req… |
CVE-2024-34814 | Medium | 5.4 | 2024-05-14 | Cross-Site Request Forgery (CSRF) vulnerability in Unyson Unyson unyson.This issue affects Unyson: from n/a through <= 2.7.29. |
CVE-2023-44472 | Medium | 4.3 | 2024-05-03 | Missing Authorization vulnerability in ThemeFuse Unyson.This issue affects Unyson: from n/a through 2.7.28. |
CVE-2024-1311 | High | 8.8 | 2024-03-13 | The Brizy – Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the storeImages function in all ve… |
CVE-2024-1296 | Medium | 6.4 | 2024-03-13 | The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's block upload in all versions up to, and including… |
CVE-2024-1293 | Medium | 6.4 | 2024-03-13 | The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the embedded media custom block in all versions up to, and inclu… |
CVE-2024-1291 | Medium | 6.4 | 2024-03-13 | The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown URL parameter in all versions up to, and including… |
CVE-2024-1165 | Medium | 4.3 | 2024-02-26 | The Brizy – Page Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.4.39 via the 'id'. This makes it pos… |
CVE-2023-51396 | Medium | 6.5 | 2023-12-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brizy.Io Brizy – Page Builder allows Stored XSS.This issu… |
CVE-2020-36714 | High | 7.4 | 2023-10-20 | The Brizy plugin for WordPress is vulnerable to authorization bypass due to a incorrect capability check on the is_administrator() function in versions up to… |
CVE-2023-2897 | Low | 3.7 | 2023-06-09 | The Brizy Page Builder plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.4.18. This is due to an implicit trust of… |
CVE-2022-2219 | High | 7.2 | 2022-07-25 | The Unyson WordPress plugin before 2.7.27 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scr… |
CVE-2022-2041 | Medium | 5.4 | 2022-06-27 | The Brizy WordPress plugin before 2.4.2 does not sanitise and escape some element content, which could allow users with a role as low as Contributor to perform… |
CVE-2022-2040 | Medium | 5.4 | 2022-06-27 | The Brizy WordPress plugin before 2.4.2 does not sanitise and escape some element URL, which could allow users with a role as low as Contributor to perform Sto… |
CVE-2021-38346 | High | 8.8 | 2021-10-14 | The Brizy Page Builder plugin <= 2.3.11 for WordPress allowed authenticated users to upload executable files to a location of their choice using the brizy_crea… |
CVE-2021-38345 | High | 7.1 | 2021-10-14 | The Brizy Page Builder plugin <= 2.3.11 for WordPress used an incorrect authorization check that allowed any logged-in user accessing any endpoint in the wp-ad… |
CVE-2021-38344 | Medium | 6.4 | 2021-10-14 | The Brizy Page Builder plugin <= 2.3.11 for WordPress was vulnerable to stored XSS by lower-privileged users such as a subscribers. It was possible to add mali… |