Administrator form submission via missing nonce validation

Cross-site request forgery in Brizy – Page Builder 2.5.1 and earlier allows remote attackers to submit forms as an administrator. The form submission handler accepts forged requests because it omits or incorrectly performs the nonce validation that should bind a submission to the active WordPress session. Exploitation requires an administrator to follow an attacker-controlled link; on sites with unfiltered_html enabled, the forged submission can store a script payload that executes in visitors' browsers.