An unauthenticated stored cross-site scripting vulnerability in the Brizy plugin for WordPress allows attackers to inject malicious web scripts that execute when administrators view form submissions.

This is a Cross-Site Scripting (CWE-79) vulnerability involving improper input neutralization during web page generation, affecting the submit_form function and FileUpload handling, with an unauthenticated attacker authentication level.

A successful exploit allows unauthenticated attackers to store malicious JavaScript payloads that execute within the context of an administrator session. This can lead to unauthorized administrative actions, session hijacking, or defacement of the affected WordPress site. Given the CVSS score of 7.2, this vulnerability represents a high risk to organizational web assets and data integrity.

Immediate Action: Update the Brizy plugin to version 2.8.12 or later, or disable the plugin immediately if an update is unavailable.

Proactive Monitoring: Monitor server access logs and WordPress activity logs for suspicious form submissions containing script tags or encoded HTML entities.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and block inbound form submissions containing cross-site scripting payloads.

Public Exploit Available: false

This vulnerability carries a high severity rating due to its unauthenticated attack vector and potential for stored cross-site scripting execution against administrative users. Security teams must prioritize applying the latest plugin updates or implementing compensating controls to prevent unauthorized script execution.