CVE-2026-56009: Stored XSS in Bricksable for Bricks Builder (CVSS 5.9)

Technical summary

CVE-2026-56009 is a stored XSS vulnerability (CWE-79) in Bricksable for Bricks Builder caused by improper input neutralization during web page generation. The CVSS v3.1 score of 5.9 (Medium) reflects the requirement for high-privilege authentication and user interaction, though the attack can impact confidentiality, integrity, and availability across security boundaries. An authenticated administrator or high-privilege user can inject unsanitized input that persists in the application's database, executing in the context of other users' sessions when they access the affected content.

Business impact

A successful exploitation could allow an insider threat or compromised high-privilege account to deface pages, steal session tokens or sensitive data from other users, or redirect users to malicious sites. In multi-user WordPress or Bricks-based environments, this poses a reputational risk and potential compliance exposure if user data is exfiltrated. The impact is narrower than unauthenticated XSS because it requires prior account compromise or insider action, but it remains a meaningful vector for lateral movement or privilege escalation within an organization.

Affected systems

Bricksable for Bricks Builder versions 1.6.83 and earlier are vulnerable. This affects any WordPress installation running Bricks Builder with the Bricksable plugin active. The vulnerability is most relevant to multi-user or agency WordPress environments where multiple administrators or editors may have elevated roles.

Exploitability

Exploitation requires authentication with high-privilege account access (typically administrator role) and user interaction—specifically, a victim must visit or interact with the page containing the injected payload. The CVSS vector (AV:N, AC:L, PR:H, UI:R) indicates the attack is network-accessible but gated by authentication and interaction. This limits opportunistic exploitation but does not eliminate risk from compromised accounts or malicious insiders.

Remediation

Update Bricksable for Bricks Builder to a patched version released after 1.6.83. Verify the latest available version directly from the Bricksable vendor or WordPress plugin repository. In the interim, restrict administrator and editor roles to trusted users only, and consider using WordPress security plugins to monitor and log high-privilege user actions.

Patch guidance

Check the Bricksable plugin repository or vendor advisory for the next available version beyond 1.6.83 that addresses input sanitization. Apply updates through the WordPress admin dashboard once available, and test thoroughly in a staging environment first given the plugin's role in page building functionality.

Detection guidance

Monitor WordPress database logs and post meta tables for unusual changes by high-privilege users, especially to Bricks elements or custom fields that might contain script content. Deploy a Web Application Firewall (WAF) rule to detect script payloads in POST requests to Bricks or page-building endpoints. Review admin activity logs for changes to published pages by high-privilege accounts, and consider alerting on rapid sequential edits to the same page.

Why prioritize this

Although CVSS scores this as Medium severity, prioritize remediation if your WordPress environment has multiple administrators, if you manage client sites (agency scenario), or if your user base is large enough that account compromise is a realistic threat model. The stored nature of the XSS amplifies impact compared to reflected XSS, and the plugin is integral to page design, making it a high-value target.

Risk score, explained

The CVSS 5.9 rating balances the relatively low barrier to entry once authenticated (AC:L, AV:N) against the requirement for high privileges (PR:H) and user interaction (UI:R). The scope change (S:C) elevates concern because the script executes in other users' security contexts. However, the vulnerability is not rated Critical because exploitation cannot occur without prior authentication compromise or insider action.

Frequently asked questions