Brizy WordPress Plugin Exploit Chains Allow Full Site Takeovers
-
A stored XSS and arbitrary file-upload bug can be paired with an authorization bypass to wreak havoc.
https://threatpost.com/brizy-wordpress-plugin-exploit-site-takeovers/175463/