CVE-2026-2585

Executive Summary

CVE-2026-2585 is a stored cross-site scripting (XSS) vulnerability in the Brizy – Page Builder plugin for WordPress, affecting all versions up to and including 2.8.14. The flaw resides in insufficient validation of the rootAttributes parameter, which fails to sanitize input and escape output. An authenticated attacker with Contributor-level access or above can inject arbitrary web scripts into pages that execute in the browser of any user viewing the compromised page, including administrators. With a CVSS base score of 6.4, the vulnerability carries a scope change (S:C), meaning the injected content can affect resources beyond the plugin's original security context, potentially leading to session hijacking, credential theft, or full site takeover.

Technical Analysis

The vulnerability is a classic stored (persistent) cross-site scripting flaw (CWE-79) introduced by missing input sanitization and output escaping on the rootAttributes parameter within the Brizy – Page Builder plugin. The parameter is user-controllable and part of the plugin's page-building functionality. Because the plugin does not properly sanitize this input before storing it and does not escape it on output, an attacker can craft a malicious value containing HTML/JavaScript that is persisted in the WordPress database and later rendered in the context of other users' browsers.

Key technical properties:

• Injection vector: rootAttributes parameter — an attribute collection used by the page builder (likely serialized JSON or a structured attribute string) that is stored with the page/post content. The exact parsing routine is not described in the available NVD data, so no further code-level specifics can be asserted without fabrication.
• Authentication requirement: Contributor-level access or higher. Contributors can create and edit their own posts but normally cannot publish them; however, pages in a page-builder context may preview or render the injected content, and an administrator or editor reviewing the draft triggers execution.
• Stored nature: Payload is persisted server-side, creating a persistent risk for every subsequent viewer.
• Output escaping failure: The plugin fails to HTML-entity-encode the rootAttributes value when it is emitted into the page markup, allowing the payload to break out of an HTML attribute context or inject a new element.
• Scope change: The CVSS vector's S:C indicates the vulnerable component's exploitation impacts resources beyond its own privilege boundary — e.g., a contributor-level user (low privilege) can affect an administrator's browser session (high privilege).

The vulnerability is not confined to a single request/response; it is a persistent condition. Once the malicious content is saved, it becomes part of the page's stored state and will be served to all visitors. No public proof-of-concept, exploit code, or Nuclei template was available at the time of reporting, so the exact payload syntax and parameter serialization cannot be confirmed from open sources.

Exploitation Scenarios

Note: No public PoC is available; the following chain is inferred from the vulnerability class (stored XSS via an unsanitized parameter) and the authentication requirements stated in the NVD description.

1. Reconnaissance / Target Identification

• Identify WordPress sites running the Brizy – Page Builder plugin. This can be done via HTTP response fingerprinting (e.g., wp-content/plugins/brizy/ paths in loaded assets) or by querying internet-wide scanners such as Shodan with the dorks provided in the metadata.
• Confirm the plugin version is ≤ 2.8.14 (vulnerable range) by examining publicly accessible plugin readme files or static resource version strings.
• Determine whether user registration is open or whether the attacker already possesses valid Contributor-level credentials. The vulnerability requires an authenticated account with at least Contributor privileges, so reconnaissance includes identifying sites where such access is obtainable (e.g., via open registration, credential reuse, or a separate account-provisioning flaw).

2. Triggering the Flaw Class (Stored XSS)

• Once authenticated as a Contributor or higher, the attacker navigates to the page builder interface and creates or edits a page/post.
• In the component that consumes the rootAttributes parameter, the attacker injects a crafted payload (e.g., <script>...</script> or an event handler like onmouseover=...) instead of a benign attribute value. Because the plugin fails to sanitize this input on save and escape it on render, the payload is stored verbatim in the database.
• The exact injection point depends on how rootAttributes is submitted (form field, JSON body, or AJAX action). The NVD description does not specify the transport, so no endpoint or request format can be asserted.

3. Payload Execution

• When any user — including an administrator or editor — views the affected page (either in the editor preview or on the live site, if the post is published or previewed), the stored payload is delivered as part of the page's HTML.
• The victim's browser parses the injected script and executes it in the origin of the WordPress site. Because there is no output escaping, the script runs with the victim's session privileges.

4. Post-Exploitation Impact

• Session hijacking: Steal session cookies or authentication tokens (if not HttpOnly-protected) to impersonate the victim.
• Privilege escalation: If an administrator views the page, the attacker can perform administrative actions via the victim's browser (CSRF-style or direct fetch calls) — e.g., create a new admin user, install a malicious plugin, or modify site content.
• Credential phishing: Inject fake login forms or overlays to capture credentials.
• Malware distribution: Redirect visitors to malicious sites or serve drive-by download payloads.
• Persistence: Since the payload is stored, it continues to affect users until the malicious content is removed or the page is deleted.

The scope change (S:C) in the CVSS vector reflects the boundary crossing: a low-privileged contributor can compromise the browsing context of higher-privileged users, ultimately placing the entire WordPress installation at risk.

Impact Assessment

• Confidentiality (C:L): Limited impact — the attacker can read data accessible to the victim's browser session, such as cookies or page content. However, if an administrator is compromised, this can expand significantly.
• Integrity (I:L): Limited impact — the attacker can modify the content rendered to the victim, inject forms, or alter the DOM. Again, administrator-level compromise could lead to broader site integrity loss.
• Availability (A:N): No direct availability impact; the vulnerability does not disrupt service.
• Scope (S:C): The exploited component (the plugin) affects resources beyond its security authority, meaning a contributor can impact administrator-level assets.
• Base Score: 6.4 (Medium). The vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N indicates network-exploitable, low complexity, low privileges required, no user interaction (for the attacker), but the victim must view the page — which is not captured in the CVSS v3.1 vector as a change to the base score beyond the standard XSS model.
• Affected Systems: Any WordPress site using the Brizy – Page Builder plugin version 2.8.14 or earlier. Given that Brizy is a popular page builder with a large install base, the blast radius includes a wide range of organizations using WordPress for corporate sites, blogs, and e-commerce.
• Business Impact:
  • Reputation damage: Defacement or malicious redirects visible to customers.
  • Data breach: Theft of user credentials or session tokens, potentially leading to GDPR/CCPA violations.
  • Supply chain risk: If the compromised site is part of a larger network, attackers may pivot to other connected systems.
  • Financial loss: Cleanup costs, potential fines, and loss of customer trust.
• Exploitability: No public exploit exists; however, the flaw is trivial to exploit for anyone with Contributor access. The lack of a CISA KEV entry suggests no known active exploitation in the wild at the time of writing, but the low complexity makes it an attractive target for opportunistic attackers.

Detection Guidance

Sigma Rule

title: Stored XSS via Brizy Page Builder rootAttributes Parameter
id: 8f4b2c1e-9a3d-4c7e-b5f6-1a2b3c4d5e6f
status: experimental
description: Detects attempts to inject script tags or event handlers into the rootAttributes parameter of the Brizy WordPress plugin.
author: valtersit.com
date: 2026-03-27
logsource:
  category: webserver
  product: apache
  service: access_combined
detection:
  selection_method:
    http.method:
      - 'POST'
      - 'PUT'
  selection_uri:
    http.url|contains:
      - 'brizy'
      - 'page-builder'
  selection_payload:
    http.body|contains:
      - 'rootAttributes'
      - '<script'
      - 'onerror='
      - 'onload='
      - 'javascript:'
      - 'alert('
  condition: selection_method and selection_uri and selection_payload
falsepositives:
  - Legitimate page builder requests containing attribute data that coincidentally includes such strings (unlikely due to specific parameter).
level: medium
tags:
  - attack.t1190
  - cwe.79

YARA Rule

rule WordPress_Brizy_Stored_XSS_rootAttributes
{
    meta:
        description = "Detects stored XSS payloads in Brizy page builder rootAttributes parameter"
        author = "valtersit.com"
        date = "2026-03-27"
        reference = "CVE-2026-2585"
        severity = "medium"

    strings:
        $param = "rootAttributes" ascii wide nocase
        $script_tag = "<script" ascii wide nocase
        $event_handler = /on(error|load|mouseover|click|focus|blur)\s*=/ ascii wide nocase
        $js_proto = "javascript:" ascii wide nocase
        $alert = "alert(" ascii wide nocase

    condition:
        $param and any of ($script_tag, $event_handler, $js_proto, $alert)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-2585 Brizy Page Builder Stored XSS via rootAttributes"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"brizy"; nocase; http.request_body; content:"rootAttributes"; nocase; http.request_body; pcre:"/<script|on(error|load|mouseover|click)\s*=|javascript:/i"; classtype:web-application-attack; reference:cve,2026-2585; sid:10000001; rev:1;)

Elastic EQL Detection

sequence by user.name
  [any where process.name == "httpd" or process.name == "nginx" or process.name == "php-fpm"]
  [any where
    (http.request.method == "POST" or http.request.method == "PUT") and
    http.request.body contains "rootAttributes" and
    (http.request.body contains "<script" or http.request.body contains "onerror=" or http.request.body contains "javascript:") and
    (http.request.url contains "brizy" or http.request.url contains "page-builder")
  ]

Splunk SPL Query

index=web sourcetype=access_combined
| search (method=POST OR method=PUT)
    (uri_path="*brizy*" OR uri_path="*page-builder*")
| rex field=form_data "(?<rootAttr>rootAttributes[^&]*)"
| where match(rootAttr, "(?i)<script|on(error|load|mouseover|click)\s*=|javascript:")
| table _time, src_ip, uri_path, rootAttr, status
| sort - _time

Wazuh OSSEC Rule

<group name="web,appsec,">
  <rule id="100200" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <url>.*(brizy|page-builder).*</url>
    <regex>rootAttributes=.*(<script|on(error|load|mouseover|click)\s*=|javascript:)</regex>
    <description>CVE-2026-2585: Possible stored XSS attempt via Brizy rootAttributes parameter</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_2585,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED — single source claims patch, not independently confirmed).

1. Immediate Mitigations (if patch not applied):

   • Disable the Brizy – Page Builder plugin until a patched version is available. This is the most reliable way to eliminate the attack surface.
   • If the plugin must remain active, restrict Contributor-level accounts and above to trusted users only. Review existing user roles and remove unnecessary privileges.
   • Implement a Web Application Firewall (WAF) rule to block requests containing rootAttributes with suspicious content (e.g., <script, onerror=, javascript:). Many WordPress security plugins offer virtual patching.
   • Enable Content Security Policy (CSP) headers to mitigate the impact of XSS by restricting inline script execution. Use script-src directives with nonces or hashes.
   • Set session cookies with HttpOnly and Secure flags to reduce the risk of session hijacking.
   • Regularly scan for stored XSS payloads using security plugins or manual code review of page builder content.

2. Patch/Upgrade Steps:

   • Monitor the official Brizy plugin repository and vendor channels for a security release addressing CVE-2026-2585. The NVD description states all versions up to and including 2.8.14 are vulnerable; a fixed version may be 2.8.15 or later, but this is not confirmed in the available data.
   • Once a patched version is released, upgrade immediately following standard WordPress plugin update procedures: back up the database and files, test in a staging environment, then deploy to production.
   • After patching, review all pages/posts created with the Brizy builder for malicious rootAttributes values and remove any injected content.

3. Long-Term Hardening:

   • Adopt a least-privilege model for WordPress user roles; grant Contributor access only to vetted users.
   • Implement regular security audits and vulnerability scanning for WordPress plugins.
   • Enforce input validation and output encoding at the application level by using secure coding practices, though this is the vendor's responsibility.
   • Deploy a Web Application Firewall with up-to-date signatures and consider using a virtual patching service.
   • Enable logging and monitoring for suspicious POST requests to plugin endpoints.
   • Subscribe to WordPress security mailing lists and follow CVE feeds for timely alerts on plugin vulnerabilities.

References

1. NVD – CVE-2026-2585: https://nvd.nist.gov/vuln/detail/CVE-2026-2585
2. WordPress Plugin Repository – Brizy: https://wordpress.org/plugins/brizy/
3. CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
4. CISA Known Exploited Vulnerabilities Catalog: Not applicable at this time (CVE not listed).
5. Brizy Official Website / Security Advisories: https://www.brizy.io/ (monitor for security announcements)

Threat Actor Campaigns / Exploit-in-the-Wild Evidence: No public evidence of active exploitation or threat actor campaigns targeting CVE-2026-2585 was available at the time of this report. The vulnerability is not listed in CISA KEV, and no public PoC or Nuclei template exists. However, given the low complexity and the popularity of the Brizy plugin, organizations should remain vigilant and apply mitigations promptly.