Bricks vulnerabilities
We track 4 vulnerabilities in Bricks products across 2 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on October 29, 2026.
Latest Bricks vulnerabilities
- 7.5 High severity
Bricks Theme: Authorization Bypass Through User-Controlled Key
Bricks Theme 2.4 and before for WordPress contains an unauthenticated broken access control vulnerability in the load_popup_content REST endpoint that allows anonymous attackers to read draft and unpublished page content by supplying a popupId parameter withou
- 7.5 High severity
Bricks Builder: Missing Authorization
Bricks Builder 2.4.3 and before contains a broken access control vulnerability that allows unauthenticated attackers to access restricted post content by submitting crafted post_status and post_type values in the originalQueryVars parameter to the POST /wp-jso
- 7.5 High severity
Bricks Theme: Improper Neutralization of Special Elements Used in a Template Engine
Bricks Theme 2.4.3 and before contains an unauthenticated dynamic-data tag injection vulnerability that allows anonymous attackers to control the urlParams object in the query_result REST endpoint, causing the submitted value to be re-parsed as a Bricks dynami
- 7.1 High severity
Bricks Builder: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bricks Builder allows Reflected XSS. This issue affects Bricks Builder: from n/a through 1.9.2 to 2.2.