Unknown Brizy vulnerabilities

4 CVEs affecting Unknown Brizy, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-16070, published 2026-08-04.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-16069, published 2026-08-04. Medium severity, CVSS 6.8. EPSS: 0.4% chance of exploitation in the next 30 days. The Brizy WordPress plugin before 2.8.19 does not sanitize or escape featured-image focal-point coordinates submitted through one of its AJAX actions before storing them and later echoing them into…
CVE-2026-14195, published 2026-08-01. Low severity, CVSS 2.7. EPSS: 0.3% chance of exploitation in the next 30 days. The Brizy WordPress plugin before 2.8.18 does not properly verify authorization on a request handler before returning post content, allowing users with the Contributor role or higher to read the…
CVE-2026-16070, published 2026-08-04. Low severity, CVSS 2.7. EPSS: 0.3% chance of exploitation in the next 30 days. The Brizy WordPress plugin before 2.8.19 does not properly verify authorization on the object being modified before updating a template's type meta, validating a request parameter that is different…
CVE-2026-16068, published 2026-08-04. Low severity, CVSS 3.5. EPSS: 0.2% chance of exploitation in the next 30 days. The Brizy WordPress plugin before 2.8.19 does not properly restrict who can modify its site-global design data and does not sanitise part of that data before outputting it, allowing authenticated…