# Brizy – Page Builder <= 2.8.23 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

- **ID:** WPSEC-2026-1286
- **Plugin:** Brizy – Page Builder (`brizy`), https://wordpress.org/plugins/brizy/
- **Affected versions:** all versions before 2.8.24
- **Fixed in:** 2.8.24 (Update to 2.8.24 or later.)
- **Severity:** Medium 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Medium, affected versions Low (as of 2026-10-21)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/brizy
- **Fix released:** 2026-10-19
- **Published:** 2026-10-21
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1286/

## Description

The Brizy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file uploads in all versions up to, and including, 2.8.23 due to the SVG sanitizer only being applied when the client-supplied MIME type equals image/svg+xml, while WordPress stores and serves the file based on its extension. This makes it possible for authenticated attackers, with author-level access and above, to upload a .svg file declared with a different MIME type, bypassing sanitization and injecting arbitrary web scripts that will execute whenever a user accesses the uploaded file.

## References

- https://wpsec.com/vuln/WPSEC-2026-1286/
- https://plugins.svn.wordpress.org/brizy/tags/2.8.24/
- https://wordpress.org/plugins/brizy/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1286/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.