Bricks Builder vulnerabilities

Latest Bricks Builder CVEs

Newest publication first

1. CVE-2026-118804 Bricks Broken Access Control via query_result Endpoint

   Published 2026-10-28

   High·CVSS 7.5

   Bricks Builder 2.4.3 and before contains a broken access control vulnerability that allows unauthenticated attackers to access restricted post content by submitting crafted post_status and post_type values in the originalQueryVars parameter to the POST /wp-json/bricks/v1/query_re...

2. CVE-2026-40723 WordPress Bricks Builder theme <= 2.1.4 - Broken Access Control vulnerability

   Published 2026-06-17

   Medium·CVSS 4.3

   Subscriber Broken Access Control in Bricks Builder <= 2.1.4 versions.

3. CVE-2026-41554 WordPress Bricks Builder theme 1.9.2-2.2 - Cross Site Scripting (XSS) vulnerability

   Published 2026-05-07

   High·CVSS 7.1 EPSS 0.14%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bricks Builder allows Reflected XSS. This issue affects Bricks Builder: from n/a through 1.9.2 to 2.2.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.