Bricks

Bricks has 9 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2026; all 9 are fixed as of September 2026. Their average CVSS score is 6.8, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 3 high. 2024 was the busiest year with 4 disclosures.

The most common weakness is Code Injection, behind 2 of the records (22%). Other recurring categories include Cross-Site Request Forgery (CSRF), Cross-Site Scripting.

Every one of the 9 issues recorded for Bricks has a vendor fix available, so running the current release closes all known holes.

5 independent researchers contributed these findings, most of them (3) reported by Ram.

Strategic Overview

Avg CVSSMedium

6.8/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Bricks vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2024-25600

Bricks <= 1.9.6 - Unauthenticated Remote Code Execution

Read the full analysis

Vulnerability Records

9 records


2026-04-23 00:00	Bricks <= 1.9.2 - Reflected Cross-Site Scripting Bricks <= 1.9.2	`CVE-2026-41554`	6.1 Medium	w41bu1	Yes
2025-07-28 16:22	Bricks Builder <= 1.12.4 - Unauthenticated SQL Injection via `p` Parameter Bricks <= 1.12.4	`CVE-2025-6495`	7.5 High	Jamie Burchell	Yes
2025-02-26 00:00	Bricksbuilder <= 1.9.6.1 - Authenticated (Contributor+) Privilege Escalation via create_autosave Bricks <= 1.9.6.1	`CVE-2024-2297`	7.1 High	etragardh	Yes
2024-09-13 00:00	Bricks <= 1.10.1 - Authenticated (Bricks Page Builder Access+) Stored Cross-Site Scripting Bricks <= 1.10.1	`CVE-2023-3410`	5.4 Medium	Ram	Yes
2024-08-16 00:00	Bricks <= 1.8.1 - Cross-Site Request Forgery via reset_settings Bricks <= 1.8.1	`CVE-2023-3409`	5.4 Medium	Ram	Yes
2024-08-16 00:00	Bricks <= 1.8.1 - Cross-Site Request Forgery via save_settings Bricks <= 1.8.1	`CVE-2023-3408`	4.3 Medium	Ram	Yes
2024-02-13 00:00	Bricks <= 1.9.6 - Unauthenticated Remote Code Execution Bricks <= 1.9.6	`CVE-2024-25600`	9.8 Critical	Snicco	Yes
2022-10-03 00:00	Bricks 1.2 - 1.5.3 - Remote Code Execution Bricks 1.2 – 1.5.3	`CVE-2022-3401`	8.8 High	Anonymous	Yes
2022-10-03 00:00	Bricks 1.0 - 1.5.3 - Missing Authorization to Arbitrary Content Creation/Modification Bricks 1.0 – 1.5.3	`CVE-2022-3400`	6.5 Medium	Anonymous	Yes

Showing 1–9 of 9 reports