CVE-2026-5324 Brizy – Page Builder <= 2.8.11 - Unauthenticated Stored Cross-Site Scripting via FileUpload Field Value
Unauthenticated attackers can inject scripts via form submissions that execute when administrators view the leads page, potentially leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-5324?
CVE-2026-5324 is a high-severity cross-site scripting vulnerability in themefusecom Brizy – Page Builder, published on 2 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Brizy – Page Builder plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in all versions up to, and including, 2.8.11 This is due to a combination of missing nonce verification for unauthenticated form submissions, insufficient handling of FileUpload fields when no file is uploaded, and the reversal of security encoding via html_entity_decode() followed by unescaped output in the admin view. The submit_form() function skips nonce verification for non-logged-in users (api.php:198). The handleFileTypeFields() function fails to overwrite user-supplied values when no file is attached. While htmlentities() is applied during storage, html_entity_decode() reverses this on display (form-entries.php:79). The form-data.php template outputs FileUpload values directly in href attributes without esc_url(). This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the form Leads page.
Weakness: CWE-79
Which versions are affected by CVE-2026-5324?
How do I fix CVE-2026-5324?
No fix has been published for CVE-2026-5324 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-5324 being exploited?
There is no known exploitation of CVE-2026-5324 in the wild and no public exploit code.
Sources
Also known as GHSA-p8xr-fh24-8289.