Skip to content
Founder-led WordPress incident response and care Request an assessment
3zerodigital Request a Website Assessment

Theme security history

Bricks Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 9 vulnerability records associated with Bricks, published between 2022 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

9Total records
1Critical
3High
5Medium
0Low
0Informational
9Patched records
0Currently marked unpatched
2022-10-03First disclosure
2026-04-23Latest disclosure
9 of 9CVE coverage

Use this history

Check and watch Bricks.

A history record does not establish whether the version installed on your website is affected. Enter the exact version in the checker, or add this software to a private Critical/High alert watchlist.

Check my installed versionWatch Bricks

Year-by-Year Timeline

YearRecordsRelative volume
202222 records
202444 records
202522 records
202611 records

Severity Breakdown

SeverityRecordsShare
Critical111.1%
High333.3%
Medium555.6%

Vulnerability-Type Breakdown

Other

2 records22.2%

First: 2022. Latest: 2024.

CSRF

2 records22.2%

First: 2024. Latest: 2024.

Cross-Site Scripting

2 records22.2%

First: 2024. Latest: 2026.

Missing Authorization

1 record11.1%

First: 2022. Latest: 2022.

Privilege Escalation

1 record11.1%

First: 2025. Latest: 2025.

SQL Injection

1 record11.1%

First: 2025. Latest: 2025.

Patch Status

Patched
9
Currently marked unpatched
0
Unknown status
0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

  • 2.3
  • 2.0
  • 1.9.7
  • 1.10.2
  • 1.8.2
  • 1.9.6.1
  • 1.5.4

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected rangeVulnerabilityPublishedPatched versionSeverity
*-1.9.2Bricks <= 1.9.2 - Reflected Cross-Site ScriptingApril 23, 20262.3Medium
*-1.12.4Bricks Builder <= 1.12.4 - Unauthenticated SQL Injection via `p` ParameterJuly 28, 20252.0High
*-1.9.6.1Bricksbuilder <= 1.9.6.1 - Authenticated (Contributor+) Privilege Escalation via create_autosaveFebruary 26, 20251.9.7High
*-1.10.1Bricks <= 1.10.1 - Authenticated (Bricks Page Builder Access+) Stored Cross-Site ScriptingSeptember 13, 20241.10.2Medium
*-1.8.1Bricks <= 1.8.1 - Cross-Site Request Forgery via save_settingsAugust 16, 20241.8.2Medium
*-1.8.1Bricks <= 1.8.1 - Cross-Site Request Forgery via reset_settingsAugust 16, 20241.8.2Medium
*-1.9.6Bricks <= 1.9.6 - Unauthenticated Remote Code ExecutionFebruary 13, 20241.9.6.1Critical
1.0-1.5.3Bricks 1.0 - 1.5.3 - Missing Authorization to Arbitrary Content Creation/ModificationOctober 3, 20221.5.4Medium
1.2-1.5.3Bricks 1.2 - 1.5.3 - Remote Code ExecutionOctober 3, 20221.5.4High

Selected source records

Latest Records

MediumCVE-2026-41554

Bricks <= 1.9.2 - Reflected Cross-Site Scripting

Published: April 23, 2026

Affected versions
*-1.9.2
Patched versions
2.3
Original Wordfence record
HighCVE-2025-6495

Bricks Builder <= 1.12.4 - Unauthenticated SQL Injection via `p` Parameter

Published: July 28, 2025

Affected versions
*-1.12.4
Patched versions
2.0
Original Wordfence record
HighCVE-2024-2297

Bricksbuilder <= 1.9.6.1 - Authenticated (Contributor+) Privilege Escalation via create_autosave

Published: February 26, 2025

Affected versions
*-1.9.6.1
Patched versions
1.9.7
Original Wordfence record
MediumCVE-2023-3410

Bricks <= 1.10.1 - Authenticated (Bricks Page Builder Access+) Stored Cross-Site Scripting

Published: September 13, 2024

Affected versions
*-1.10.1
Patched versions
1.10.2
Original Wordfence record
MediumCVE-2023-3409

Bricks <= 1.8.1 - Cross-Site Request Forgery via reset_settings

Published: August 16, 2024

Affected versions
*-1.8.1
Patched versions
1.8.2
Original Wordfence record
MediumCVE-2023-3408

Bricks <= 1.8.1 - Cross-Site Request Forgery via save_settings

Published: August 16, 2024

Affected versions
*-1.8.1
Patched versions
1.8.2
Original Wordfence record
CriticalCVE-2024-25600

Bricks <= 1.9.6 - Unauthenticated Remote Code Execution

Published: February 13, 2024

Affected versions
*-1.9.6
Patched versions
1.9.6.1
Original Wordfence record
HighCVE-2022-3401

Bricks 1.2 - 1.5.3 - Remote Code Execution

Published: October 3, 2022

Affected versions
1.2-1.5.3
Patched versions
1.5.4
Original Wordfence record

Highest-Severity Records

CriticalCVE-2024-25600

Bricks <= 1.9.6 - Unauthenticated Remote Code Execution

Published: February 13, 2024

Affected versions
*-1.9.6
Patched versions
1.9.6.1
Original Wordfence record
HighCVE-2022-3401

Bricks 1.2 - 1.5.3 - Remote Code Execution

Published: October 3, 2022

Affected versions
1.2-1.5.3
Patched versions
1.5.4
Original Wordfence record
HighCVE-2025-6495

Bricks Builder <= 1.12.4 - Unauthenticated SQL Injection via `p` Parameter

Published: July 28, 2025

Affected versions
*-1.12.4
Patched versions
2.0
Original Wordfence record
HighCVE-2024-2297

Bricksbuilder <= 1.9.6.1 - Authenticated (Contributor+) Privilege Escalation via create_autosave

Published: February 26, 2025

Affected versions
*-1.9.6.1
Patched versions
1.9.7
Original Wordfence record
MediumCVE-2022-3400

Bricks 1.0 - 1.5.3 - Missing Authorization to Arbitrary Content Creation/Modification

Published: October 3, 2022

Affected versions
1.0-1.5.3
Patched versions
1.5.4
Original Wordfence record
MediumCVE-2026-41554

Bricks <= 1.9.2 - Reflected Cross-Site Scripting

Published: April 23, 2026

Affected versions
*-1.9.2
Patched versions
2.3
Original Wordfence record
MediumCVE-2023-3409

Bricks <= 1.8.1 - Cross-Site Request Forgery via reset_settings

Published: August 16, 2024

Affected versions
*-1.8.1
Patched versions
1.8.2
Original Wordfence record
MediumCVE-2023-3410

Bricks <= 1.10.1 - Authenticated (Bricks Page Builder Access+) Stored Cross-Site Scripting

Published: September 13, 2024

Affected versions
*-1.10.1
Patched versions
1.10.2
Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware RemovalWordPress Security MaintenanceContact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory