WordPress brizy has 21 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2024-1311 | The Brizy – Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the storeImages | high | 8.8 | <2.4.41 | 2.4.41 |
| CVE-2024-3242 | The Brizy – Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file extension validation in the valida | high | 8.8 | <2.4.45 | 2.4.45 |
| CVE-2024-10960 | The Brizy – Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'storeUploa | critical | 9.9 | <2.6.5 | 2.6.5 |
| CVE-2024-1165 | The Brizy – Page Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.4.39 via the 'id' | medium | 4.3 | <2.4.40 | 2.4.40 |
| CVE-2022-2040 | The Brizy WordPress plugin before 2.4.2 does not sanitise and escape some element URL, which could allow users with a role as low as Contrib | medium | 5.4 | <2.4.2 | 2.4.2 |
| CVE-2022-2041 | The Brizy WordPress plugin before 2.4.2 does not sanitise and escape some element content, which could allow users with a role as low as Con | medium | 5.4 | <2.4.2 | 2.4.2 |
| CVE-2020-36714 | The Brizy plugin for WordPress is vulnerable to authorization bypass due to a incorrect capability check on the is_administrator() function | high | 7.4 | <=1.0.125 | – |
| CVE-2024-1296 | The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's block upload in all versions up | medium | 6.4 | <2.4.41 | 2.4.41 |
| CVE-2024-1293 | The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the embedded media custom block in all versio | medium | 6.4 | <2.4.41 | 2.4.41 |
| CVE-2024-1291 | The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown URL parameter in all versions u | medium | 6.4 | <2.4.41 | 2.4.41 |
| CVE-2024-2087 | The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form name values in all versions up to, a | high | 7.2 | <2.4.44 | 2.4.44 |
| CVE-2024-1937 | The Brizy – Page Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'u | high | 7.1 | <2.4.45 | 2.4.45 |
| CVE-2024-10322 | The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up | medium | 6.4 | <2.6.9 | 2.6.9 |
| CVE-2024-3711 | The Brizy – Page Builder plugin for WordPress is vulnerable to unauthorized plugin setting update due to a missing capability check on the f | medium | 4.3 | <2.4.44 | 2.4.44 |
| CVE-2024-3667 | The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Link To' field of multiple widgets in al | high | 7.4 | <2.4.44 | 2.4.44 |
| CVE-2024-6254 | The Brizy – Page Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.1. This | medium | 4.3 | <2.5.2 | 2.5.2 |
| CVE-2023-2897 | The Brizy Page Builder plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.4.18. This is due to an | low | 3.7 | <=2.4.18 | – |
| CVE-2025-4370 | The Brizy – Page Builder plugin for WordPress is vulnerable to limited file uploads due to missing authorization on process_external_asset_u | medium | 5.3 | <2.6.21 | 2.6.21 |
| CVE-2024-1940 | The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post content in all versions up to, and inclu | high | 7.1 | <2.4.42 | 2.4.42 |
| CVE-2024-1161 | The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Custom Attributes for blocks in | medium | 6.4 | <2.4.44 | 2.4.44 |
| CVE-2024-1164 | The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's contact form widget error messag | medium | 6.4 | <2.4.44 | 2.4.44 |
Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden wordpress /var/www/html
Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.
Install docs How findings are ranked