CVE-2026-16068: Unknown Brizy

Low severity, CVSS 3.5. EPSS: 0.2% chance of exploitation in the next 30 days.

The Brizy WordPress plugin before 2.8.19 does not properly restrict who can modify its site-global design data and does not sanitise part of that data before outputting it, allowing authenticated users with Author-level access and above to store arbitrary JavaScript that is then served unsanitised on the site's front-end pages and executes in the browser of every visitor, including administrators.

Affected products

• Unknown Brizy: before 2.8.19 (fixed in 2.8.19)

Published 2026-08-04. Last modified 2026-08-26.