Brizy WordPress Plugin CVE-2026-5324: Unauthenticated Stored XSS

title: CVE-2026-5324: Brizy Unauthenticated Stored XSS via Form Submission
id: scw-2026-05-02-ai-1
status: experimental
level: high
description: |
  This rule detects attempts to exploit CVE-2026-5324 by targeting the Brizy WordPress plugin's unauthenticated form submission endpoint. Attackers can submit malicious data, including script tags, through the 'brizy_submit_form' action in 'admin-ajax.php' without authentication. The vulnerability lies in how the plugin handles file uploads and sanitizes data, allowing stored XSS to be executed when an administrator views the form entries. This rule specifically looks for the vulnerable endpoint and action, assuming POST data inspection is available.
author: SCW Feed Engine (AI-generated)
date: 2026-05-02
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-5324/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/wp-admin/admin-ajax.php'
      cs-uri-query|contains:
          - 'action=brizy_submit_form'
      cs-method|exact:
          - 'POST'
      # The actual payload would be in the POST body, which is not directly queryable in many log sources.
      # This rule assumes the webserver logs include POST body data or a WAF logs it.
      # A more robust detection would require WAF logs or application-level logging.
      # Example of a potential payload indicator (highly specific and might require tuning):
      # body|contains:
      #     - 'brizy_field_type=fileupload'
      #     - '<script>'
      condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse