Brizy\-Page_builder - Vulncode-DB

Repositories	Unknown: This might be proprietary software.
#Vulnerabilities	13

Date	Id	Summary	Products	Score
2022-06-27	CVE-2022-2041	The Brizy WordPress plugin before 2.4.2 does not sanitise and escape some element content, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks	Brizy\-Page_builder	5.4
2021-10-14	CVE-2021-38344	The Brizy Page Builder plugin <= 2.3.11 for WordPress was vulnerable to stored XSS by lower-privileged users such as a subscribers. It was possible to add malicious JavaScript to a page by modifying the request sent to update the page via the brizy_update_item AJAX action and adding JavaScript to the data parameter, which would be executed in the session of any visitor viewing or previewing the post or page.	Brizy\-Page_builder	5.4
2021-10-14	CVE-2021-38346	The Brizy Page Builder plugin <= 2.3.11 for WordPress allowed authenticated users to upload executable files to a location of their choice using the brizy_create_block_screenshot AJAX action. The file would be named using the id parameter, which could be prepended with "../" to perform directory traversal, and the file contents were populated via the ibsf parameter, which would be base64-decoded and written to the file. While the plugin added a .jpg extension to all uploaded filenames, a...	Brizy\-Page_builder	8.8