CVE-2026-15647
MediumCVSS 4.4Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
The Brands for WooCommerce plugin for WordPress up to version 3.8.8 is vulnerable to Stored Cross-Site Scripting via the 'br_brand_tooltip' Term Meta field. Insufficient input sanitization and output escaping allow authenticated attackers with custom-level access and above to inject arbitrary scripts that execute on every page visit. Even Shop Manager users (without unfiltered_html) can exploit this.
Risk Assessment
An attacker can inject malicious scripts that execute in other users' browsers, potentially leading to session theft, redirects, or other attacks.
Recommendation
Update the Brands for WooCommerce plugin to the latest version that includes the fix or apply temporary mitigations such as input filtering.
Other vulnerabilities in Brands for WooCommerce
See all- CVE-2026-15648Medium
The Brands for WooCommerce plugin for WordPress is vulnerable to Stored XSS via the 'width' Shortcode Attribute due to insufficient input sanitization. Attackers with contributor-level access can inject arbitrary scripts.
- CVE-2026-15646Medium
The Brands for WooCommerce plugin for WordPress up to version 3.8.8 has a Stored XSS vulnerability in the 'style' shortcode attribute. Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject scripts.
Original NVD description (English source)
The Brands for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'br_brand_tooltip' Term Meta Field in all versions up to, and including, 3.8.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Because the payload is stored in term meta rather than post content, the WordPress unfiltered_html capability exception does not apply, meaning Shop Manager-level users — who normally lack unfiltered_html — can fully exploit this vulnerability.