{"uuid": "e29abd77-4400-4a3d-905b-813421397533", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14882", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117415041431466618", "content": "CVE-2026-14882 Brizy <= 2.8.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'brizy-compiled-sections' Post Meta The Brizy \u2013 Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'brizy-compiled-sections' parameter in all versions up to, and including, 2.8.18 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.\nhttps://www.cve.org/CVERecord?id=CVE-2026-14882https://www.wordfence.com/threat-intel/vulnerabilities/id/e83d4254-74db-4230-a641-fc078291350d?source=cvehttps://plugins.trac.wordpress.org/changeset/3619520/brizy#wordpress #themefusecom #Brizy\u2013PageBuilder#CVE_2026_14882#bot", "creation_timestamp": "2026-10-10T05:49:11.182402Z"}