Brizy Page Builder Unauthenticated Stored XSS Vulnerability

The Brizy – Page Builder plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in all versions up to, and including, 2.8.11 This is due to a combination of missing nonce verification for unauthenticated form submissions, insufficient handling of FileUpload fields when no file is uploaded, and the reversal of security encoding via html_entity_decode() followed by unescaped output in the admin view. The submit_form() function skips nonce verification for non-logged-in users (api.php:198). The handleFileTypeFields() function fails to overwrite user-supplied values when no file is attached. While htmlentities() is applied during storage, html_entity_decode() reverses this on display (form-entries.php:79). The form-data.php template outputs FileUpload values directly in href attributes without esc_url(). This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the form Leads page.

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills have been training on — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Brizy Page Builder plugin for WordPress contains a critical stored cross-site scripting (XSS) vulnerability affecting all versions up to 2.8.11. This flaw exploits a dangerous combination of missing nonce verification, improper file upload field handling, and security encoding reversal through html_entity_decode() followed by unescaped output. Because the vulnerability allows unauthenticated attackers to submit malicious payloads through form fields, any WordPress site running this plugin is at risk of compromise. Attackers can inject persistent XSS code that executes in the context of admin dashboards and user browsers, potentially leading to account takeover, credential theft, and site-wide defacement. With over 100,000+ active installations, this vulnerability has broad impact across the WordPress ecosystem.

Casky's 301 mapped security skills leverage Claude's extended reasoning to detect the attack patterns associated with this CVE across two critical MITRE ATT&ACK techniques: TA0001 (Initial Access) and TA0043 (Reconnaissance). Practitioners using Casky would identify detection signals including: (1) unusual form submissions lacking nonce tokens to unauthenticated endpoints, (2) FileUpload field requests with empty or suspicious payloads in request bodies, (3) html_entity_decode() function calls processing user input before rendering, and (4) unescaped HTML output in admin views containing script tags or event handlers. The platform's skill framework would surface findings showing how attackers probe for vulnerable form handlers, map application architecture through form enumeration, and inject stored payloads that execute during admin panel access—enabling security teams to block exploitation chains before malicious code persists.

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-5324.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Practise detecting this in the Casky Playground

Run Claude AI skills against real targets and see findings like those behind CVE-2026-5324 — before the next CVE drops.

Join the Playground Waitlist →

X Instagram LinkedIn