Plugin security history

Brizy – Page Builder Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 31 vulnerability records associated with Brizy – Page Builder, published between 2020 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

31Total records

1Critical

10High

19Medium

1Low

0Informational

31Patched records

0Currently marked unpatched

2020-03-05First disclosure

2026-05-01Latest disclosure

30 of 31CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2020	3	3 records
2021	2	2 records
2022	2	2 records
2023	2	2 records
2024	14	14 records
2025	6	6 records
2026	2	2 records

Severity Breakdown

Severity	Records	Share
Critical	1	3.2%
High	10	32.3%
Medium	19	61.3%
Low	1	3.2%

Vulnerability-Type Breakdown

Cross-Site Scripting

16 records51.6%

First: 2020. Latest: 2026.

Missing Authorization

7 records22.6%

First: 2020. Latest: 2026.

Arbitrary File Upload

4 records12.9%

First: 2021. Latest: 2025.

Other

1 record3.2%

First: 2023. Latest: 2023.

Path Traversal

1 record3.2%

First: 2024. Latest: 2024.

CSRF

1 record3.2%

First: 2024. Latest: 2024.

Information Disclosure

1 record3.2%

First: 2025. Latest: 2025.

Patch Status

Patched: 31
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

2.8.12
2.7.24
2.7.17
2.7.13
2.6.21
2.7.8
2.6.9
2.6.5
2.5.2
2.4.45
2.4.44
2.4.42
2.4.41
2.4.30
2.4.19
2.4.2
2.3.12
1.0.126
1.0.114

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-2.8.11`	Brizy – Page Builder <= 2.8.11 - Unauthenticated Stored Cross-Site Scripting via FileUpload Field Value	May 1, 2026	2.8.12	High
`*-2.7.23`	Brizy <= 2.7.23 - Missing Authorization	February 22, 2026	2.7.24	Medium
`*-2.7.16`	Brizy – Page Builder <= 2.7.16 - Authenticated (Contributor+) Sensitive Information Exposure via get_users Function	December 12, 2025	2.7.17	Medium
`*-2.7.12`	Brizy <= 2.7.12 - Missing Authorization	September 3, 2025	2.7.13	Medium
`*-2.6.20`	Brizy <= 2.6.20 - Missing Authorization to Unauthenticated Limited File Upload	July 28, 2025	2.6.21	Medium
`*-2.7.7`	Brizy <= 2.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting	April 4, 2025	2.7.8	Medium
`*-2.6.8`	Brizy – Page Builder <= 2.6.8 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload	February 12, 2025	2.6.9	Medium
`*-2.6.4`	Brizy – Page Builder <= 2.6.4 - Authenticated (Contributor+) Arbitrary File Upload via storeUploads	February 11, 2025	2.6.5	Critical
`*-2.5.1`	Brizy – Page Builder <= 2.5.1 - Cross-Site Request Forgery	August 7, 2024	2.5.2	Medium
`*-2.4.44`	Brizy – Page Builder <= 2.4.44 - Authenticated (Contributor+) Arbitrary File Upload	July 17, 2024	2.4.45	High
`*-2.4.44`	Brizy – Page Builder <= 2.4.44 - Missing Authorization to Authenticated (Contributor+) Post Modification	July 15, 2024	2.4.45	High
`*-2.4.43`	Brizy – Page Builder <= 2.4.43 - Authenticated(Contributor+) Stored Cross-Site Scripting via Form Functionality	June 4, 2024	2.4.44	Medium
`*-2.4.43`	Brizy – Page Builder <= 2.4.43 - Unauthenticated Stored Cross-Site Scripting via Form	June 4, 2024	2.4.44	High
`*-2.4.43`	Brizy – Page Builder <= 2.4.43 - Authenticated (Contributor+) Store Cross-Site Scripting via Widget Link To URL	June 4, 2024	2.4.44	High
`*-2.4.43`	Brizy – Page Builder <= 2.4.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Attributes	June 4, 2024	2.4.44	Medium
`*-2.4.43`	Brizy – Page Builder <= 2.4.43 - Missing Authorization	May 22, 2024	2.4.44	Medium
`*-2.4.41`	Brizy – Page Builder <= 2.4.41 - Authenticated(Contributor+) Stored Cross-Site Scripting	May 6, 2024	2.4.42	High
`*-2.4.40`	Brizy – Page Builder <= 2.4.40 - Authenticated (Contributor+) Stored Cross-Site Scripting	February 23, 2024	2.4.41	Medium
`*-2.4.40`	Brizy – Page Builder <= 2.4.40 - Authenticated (Contributor+) Arbitrary File Upload	February 23, 2024	2.4.41	High
`*-2.4.40`	Brizy – Page Builder <= 2.4.39 - Authenticated (Contributor+) Directory Traversal	February 23, 2024	2.4.41	Medium
`*-2.4.40`	Brizy – Page Builder <= 2.4.40 - Authenticated (Contributor+) Stored Cross-Site Scripting	February 23, 2024	2.4.41	Medium
`*-2.4.40`	Brizy – Page Builder <= 2.4.40 - Authenticated (Contributor+) Stored Cross-Site Scripting	February 23, 2024	2.4.41	Medium
`*-2.4.29`	Brizy <= 2.4.29 - Cross-Site Scripting	November 6, 2023	2.4.30	Medium
`*-2.4.18`	Brizy Page Builder <= 2.4.18 - IP Address Spoofing to Protection Mechanism Bypass	May 31, 2023	2.4.19	Low
`[*, 2.4.2)`	Brizy Page Builder <= 2.4.1 - Authenticated Stored Cross-Site Scripting via Element Content	June 21, 2022	2.4.2	Medium

Selected source records

Latest Records

HighCVE-2026-5324

Brizy – Page Builder <= 2.8.11 - Unauthenticated Stored Cross-Site Scripting via FileUpload Field Value

Published: May 1, 2026

Affected versions: *-2.8.11
Patched versions: 2.8.12

Original Wordfence record

MediumCVE-2026-32408

Brizy <= 2.7.23 - Missing Authorization

Published: February 22, 2026

Affected versions: *-2.7.23
Patched versions: 2.7.24

Original Wordfence record

MediumCVE-2025-0969

Brizy – Page Builder <= 2.7.16 - Authenticated (Contributor+) Sensitive Information Exposure via get_users Function

Published: December 12, 2025

Affected versions: *-2.7.16
Patched versions: 2.7.17

Original Wordfence record

MediumCVE-2025-58594

Brizy <= 2.7.12 - Missing Authorization

Published: September 3, 2025

Affected versions: *-2.7.12
Patched versions: 2.7.13

Original Wordfence record

MediumCVE-2025-4370

Brizy <= 2.6.20 - Missing Authorization to Unauthenticated Limited File Upload

Published: July 28, 2025

Affected versions: *-2.6.20
Patched versions: 2.6.21

Original Wordfence record

MediumCVE-2025-32198

Brizy <= 2.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: April 4, 2025

Affected versions: *-2.7.7
Patched versions: 2.7.8

Original Wordfence record

MediumCVE-2024-10322

Brizy – Page Builder <= 2.6.8 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

Published: February 12, 2025

Affected versions: *-2.6.8
Patched versions: 2.6.9

Original Wordfence record

CriticalCVE-2024-10960

Brizy – Page Builder <= 2.6.4 - Authenticated (Contributor+) Arbitrary File Upload via storeUploads

Published: February 11, 2025

Affected versions: *-2.6.4
Patched versions: 2.6.5

Original Wordfence record

Highest-Severity Records

CriticalCVE-2024-10960

Brizy – Page Builder <= 2.6.4 - Authenticated (Contributor+) Arbitrary File Upload via storeUploads

Published: February 11, 2025

Affected versions: *-2.6.4
Patched versions: 2.6.5

Original Wordfence record

HighCVE-2024-3242

Brizy – Page Builder <= 2.4.44 - Authenticated (Contributor+) Arbitrary File Upload

Published: July 17, 2024

Affected versions: *-2.4.44
Patched versions: 2.4.45

Original Wordfence record

HighCVE-2024-1311

Brizy – Page Builder <= 2.4.40 - Authenticated (Contributor+) Arbitrary File Upload

Published: February 23, 2024

Affected versions: *-2.4.40
Patched versions: 2.4.41

Original Wordfence record

HighCVE-2021-38346

Brizy Page Builder <= 2.3.11 - Authenticated File Upload and Path Traversal

Published: October 13, 2021

Affected versions: *-2.3.11
Patched versions: 2.3.12

Original Wordfence record

HighCVE-2020-36714

Brizy < 1.0.126 - Authorization Bypass to Settings Updates

Published: June 3, 2020

Affected versions: [*, 1.0.126)
Patched versions: 1.0.126

Original Wordfence record

HighCVE-2024-3667

Brizy – Page Builder <= 2.4.43 - Authenticated (Contributor+) Store Cross-Site Scripting via Widget Link To URL

Published: June 4, 2024

Affected versions: *-2.4.43
Patched versions: 2.4.44

Original Wordfence record

HighCVE-2024-2087

Brizy – Page Builder <= 2.4.43 - Unauthenticated Stored Cross-Site Scripting via Form

Published: June 4, 2024

Affected versions: *-2.4.43
Patched versions: 2.4.44

Original Wordfence record

HighCVE-2026-5324

Brizy – Page Builder <= 2.8.11 - Unauthenticated Stored Cross-Site Scripting via FileUpload Field Value

Published: May 1, 2026

Affected versions: *-2.8.11
Patched versions: 2.8.12

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory