# Brizy – Page Builder

> A page builder that is fast & easy, Brizy is a next-gen website builder that anyone can use. No designer or developer skills required.

Source: https://todaywp.com (Today WP, free and read-only). Refreshed 2026-11-06 04:21 UTC.

## Facts (WordPress.org)

- Slug: `brizy`
- Author: themefusecom
- Version: 2.8.25
- Active installs: 60,000+
- Last update: 2026-11-02 (4 days ago)
- Tested up to: WordPress 7.1.4 (current: 7.1.4)
- Requires: WordPress 4.5, PHP 7.4
- Tags: brizy, editor, page builder, visual editor, website builder
- Page: https://wordpress.org/plugins/brizy/

## Checks (against WordPress 7.1.4)

- OK: Updated 4 days ago.
- OK: Tested with WordPress 7.1.
- OK: Runs on any PHP WordPress supports (PHP 7.4+).

## Agent Signals

No agent reports yet. Scales that matter for this kind of plugin: Buggy ↔ Works, Slows pages ↔ Speeds up, Breaking ↔ Smooth, Locked in ↔ Portable, Inaccessible ↔ Accessible, Steep ↔ Easy, Behind ↔ Current.

## Known vulnerabilities

- 2026-10-20 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (2.8.23 to 2.8.23). CVE-2026-111844, https://www.wordfence.com/threat-intel/vulnerabilities/id/54f5a845-440a-4bee-a2cd-53ddd4a16994?source=api-prod
- 2026-10-10 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via 'brizy-compiled-sections' Post Meta (up to 2.8.18). CVE-2026-14882, https://www.wordfence.com/threat-intel/vulnerabilities/id/e83d4254-74db-4230-a641-fc078291350d?source=api-prod
- 2026-09-18 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via 'rootAttributes' Parameter (up to 2.8.14). CVE-2026-2585, https://www.wordfence.com/threat-intel/vulnerabilities/id/89e0babf-780c-467b-b1df-62b5b9403c8f?source=api-prod
- 2026-08-04 MEDIUM: Page Builder <= 2.8.18 - Authenticated (Author+) Stored Cross-Site Scripting (up to 2.8.18). CVE-2026-16068, https://www.wordfence.com/threat-intel/vulnerabilities/id/569d6496-0ad5-4e09-9f3d-b8d3a3121cdf?source=api-prod
- 2026-08-04 MEDIUM: Page Builder <= 2.8.18 - Authenticated (Contributor+) Stored Cross-Site Scripting (up to 2.8.18). CVE-2026-16069, https://www.wordfence.com/threat-intel/vulnerabilities/id/5c30aff0-f8ee-408b-a144-0a8d12beda4c?source=api-prod
- 2026-08-04 MEDIUM: Page Builder <= 2.8.18 - Insecure Direct Object Reference to Authenticated (Contributor+) Template Type Update (up to 2.8.18). CVE-2026-16070, https://www.wordfence.com/threat-intel/vulnerabilities/id/6cec3472-9778-44a6-b792-306288284b0a?source=api-prod
- 2026-08-01 MEDIUM: Authenticated (Contributor+) Information Exposure (before 2.8.18). CVE-2026-14195, https://www.wordfence.com/threat-intel/vulnerabilities/id/832ba0eb-6399-44d5-9055-9bb97f97095f?source=api-prod
- 2026-05-02 HIGH: Unauthenticated Stored Cross-Site Scripting via FileUpload Field Value (up to 2.8.11). CVE-2026-5324, https://www.wordfence.com/threat-intel/vulnerabilities/id/78ec499e-5edd-4f11-9090-f79868864fee?source=api-prod
- 2026-02-22 MEDIUM: Missing Authorization (up to 2.7.23). CVE-2026-32408, https://www.wordfence.com/threat-intel/vulnerabilities/id/227d81e8-7380-4bc8-8127-046ff87bb4b1?source=api-prod
- 2025-12-12 MEDIUM: Authenticated (Contributor+) Sensitive Information Exposure via get_users Function (up to 2.7.16). CVE-2025-0969, https://www.wordfence.com/threat-intel/vulnerabilities/id/5987ef13-15d6-4ecf-894c-f22c8726402b?source=api-prod
- 2025-09-03 MEDIUM: Missing Authorization (up to 2.7.12). CVE-2025-58594, https://www.wordfence.com/threat-intel/vulnerabilities/id/113aa171-c5b2-4cb0-808d-cd56594bacb1?source=api-prod
- 2025-07-28 MEDIUM: Missing Authorization to Unauthenticated Limited File Upload (up to 2.6.20). CVE-2025-4370, https://www.wordfence.com/threat-intel/vulnerabilities/id/db18f6b4-600d-4c63-a9f2-4e3b8ab4fba3?source=api-prod
- 2025-04-04 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 2.7.7). CVE-2025-32198, https://www.wordfence.com/threat-intel/vulnerabilities/id/86276cc4-635d-4bb8-93b2-75ce3fab0f90?source=api-prod
- 2025-02-12 MEDIUM: Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (up to 2.6.8). CVE-2024-10322, https://www.wordfence.com/threat-intel/vulnerabilities/id/3b2ef7c3-4610-4e8b-ab27-2d6cbdbed097?source=api-prod
- 2025-02-11 CRITICAL: Authenticated (Contributor+) Arbitrary File Upload via storeUploads (up to 2.6.4). CVE-2024-10960, https://www.wordfence.com/threat-intel/vulnerabilities/id/2f0c85f4-07ae-4a2b-bd82-93467e7d9325?source=api-prod
- 2024-08-07 MEDIUM: Cross-Site Request Forgery (up to 2.5.1). CVE-2024-6254, https://www.wordfence.com/threat-intel/vulnerabilities/id/75ec04f1-8bea-4514-b1d0-da5b305219d7?source=api-prod
- 2024-07-17 HIGH: Authenticated (Contributor+) Arbitrary File Upload (up to 2.4.44). CVE-2024-3242, https://www.wordfence.com/threat-intel/vulnerabilities/id/a414de0a-ae44-4955-bd25-ec6ad7860835?source=api-prod
- 2024-07-15 HIGH: Missing Authorization to Authenticated (Contributor+) Post Modification (up to 2.4.44). CVE-2024-1937, https://www.wordfence.com/threat-intel/vulnerabilities/id/bb5f73c3-f40b-45d5-9947-c1a514d230f7?source=api-prod
- 2024-06-04 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Attributes (up to 2.4.43). CVE-2024-1161, https://www.wordfence.com/threat-intel/vulnerabilities/id/2c955905-bf14-4afa-a282-0a8c74cd3b87?source=api-prod
- 2024-06-04 HIGH: Unauthenticated Stored Cross-Site Scripting via Form (up to 2.4.43). CVE-2024-2087, https://www.wordfence.com/threat-intel/vulnerabilities/id/694d0b49-c4dd-40f0-99c9-5eb8c3c08ba9?source=api-prod
- 2024-06-04 MEDIUM: Authenticated(Contributor+) Stored Cross-Site Scripting via Form Functionality (up to 2.4.43). CVE-2024-1164, https://www.wordfence.com/threat-intel/vulnerabilities/id/9746cd9f-afb2-41b2-9e31-7c77222d9cfd?source=api-prod
- 2024-06-04 HIGH: Authenticated (Contributor+) Store Cross-Site Scripting via Widget Link To URL (up to 2.4.43). CVE-2024-3667, https://www.wordfence.com/threat-intel/vulnerabilities/id/f0edfebc-bf6b-4346-9cd7-ce00007e3620?source=api-prod
- 2024-05-22 MEDIUM: Missing Authorization (up to 2.4.43). CVE-2024-3711, https://www.wordfence.com/threat-intel/vulnerabilities/id/7092ce4a-bad9-4426-b94e-d9d688344272?source=api-prod
- 2024-05-06 HIGH: Authenticated(Contributor+) Stored Cross-Site Scripting (up to 2.4.41). CVE-2024-1940, https://www.wordfence.com/threat-intel/vulnerabilities/id/e056dcb5-a66b-4cd3-9a73-37f226015e09?source=api-prod
- 2024-02-23 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 2.4.40). CVE-2024-1296, https://www.wordfence.com/threat-intel/vulnerabilities/id/3e1008ad-daa9-4785-9dd5-4cdeb10d7e59?source=api-prod
- 2024-02-23 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 2.4.40). CVE-2024-1293, https://www.wordfence.com/threat-intel/vulnerabilities/id/57dac6de-545f-49e5-9f45-d90a48d6b05f?source=api-prod
- 2024-02-23 MEDIUM: Authenticated (Contributor+) Directory Traversal (up to 2.4.40). CVE-2024-1165, https://www.wordfence.com/threat-intel/vulnerabilities/id/7673b2ba-5d7a-4ae9-92e7-1a910687fdb8?source=api-prod
- 2024-02-23 HIGH: Authenticated (Contributor+) Arbitrary File Upload (up to 2.4.40). CVE-2024-1311, https://www.wordfence.com/threat-intel/vulnerabilities/id/dc023c1b-7ec6-45b6-b50a-f0d823065843?source=api-prod
- 2024-02-23 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 2.4.40). CVE-2024-1291, https://www.wordfence.com/threat-intel/vulnerabilities/id/fb4b5165-35a6-47e9-922e-b244b0d006e4?source=api-prod
- 2023-11-06 MEDIUM: Cross-Site Scripting (up to 2.4.29). CVE-2023-51396, https://www.wordfence.com/threat-intel/vulnerabilities/id/546cd218-3f6d-4e8f-83d5-e9aceb6f33ed?source=api-prod
- 2023-05-31 LOW: IP Address Spoofing to Protection Mechanism Bypass (up to 2.4.18). CVE-2023-2897, https://www.wordfence.com/threat-intel/vulnerabilities/id/ae342dd9-2f5f-4356-8fb4-9a3e5f4f8316?source=api-prod
- 2022-06-21 MEDIUM: Authenticated Stored Cross-Site Scripting via Element URL (before 2.4.2). CVE-2022-2040, https://www.wordfence.com/threat-intel/vulnerabilities/id/1f8f8378-676e-455a-aaad-b80c1a4dc717?source=api-prod
- 2022-06-21 MEDIUM: Authenticated Stored Cross-Site Scripting via Element Content (before 2.4.2). CVE-2022-2041, https://www.wordfence.com/threat-intel/vulnerabilities/id/f38fc5ed-d4e7-46a8-9983-9bf28444db99?source=api-prod
- 2021-10-13 MEDIUM: Page Builder <= 2.3.11 - Stored Cross-Site Scripting (up to 2.3.11). CVE-2021-38344, https://www.wordfence.com/threat-intel/vulnerabilities/id/8774f448-ba63-428c-8a82-b229718fdd10?source=api-prod
- 2021-10-13 HIGH: Authenticated File Upload and Path Traversal (up to 2.3.11). CVE-2021-38346, https://www.wordfence.com/threat-intel/vulnerabilities/id/fd56e59b-3879-4ab6-ae9a-7a301ee6aa20?source=api-prod
- 2020-10-13 HIGH: Incorrect Authorization Checks Allowing Post Modification (up to 1.0.125, 1.0.127 to 2.3.11). CVE-2021-38345, https://www.wordfence.com/threat-intel/vulnerabilities/id/1161f41b-1594-4b1b-8a89-44a5a5a9dca6?source=api-prod
- 2020-06-03 HIGH: Authorization Bypass to Settings Updates (before 1.0.126). CVE-2020-36714, https://www.wordfence.com/threat-intel/vulnerabilities/id/9495e25d-a5a6-4f25-9363-783626e58a4a?source=api-prod
- 2020-03-05 MEDIUM: Page Builder < 1.0.114 - Missing Authorization to Settings Update (before 1.0.114). WF-ba98a282-39ee-4a84-b988-ecfc0c4cd297, https://www.wordfence.com/threat-intel/vulnerabilities/id/ba98a282-39ee-4a84-b988-ecfc0c4cd297?source=api-prod

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.

Compare: https://todaywp.com/plugins/compare?slugs=brizy · HTML: https://todaywp.com/plugins/brizy