CVE-2026-48202
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
The Brave Popup Builder WordPress plugin (Brave) through version 0.8.8 contains a Basic XSS vulnerability due to improper neutralization of script-related HTML tags. This allows code injection into the page.
Risk Assessment
An attacker can inject malicious script that executes in the user's browser, potentially leading to session or data theft. The risk affects sites using the vulnerable plugin version.
Recommendation
Update the Brave Popup Builder plugin to a version later than 0.8.8. Until then, consider disabling the plugin.
Other vulnerabilities in Brave Popup Builder
See all- CVE-2026-77116Medium
The Brave Popup Builder plugin up to version 0.8.5 has a broken access control issue. Any logged-in user, even Subscriber or WooCommerce Customer, can read popup content they shouldn't have access to by passing a post ID in the URL.
- CVE-2026-77115High
The Brave Popup Builder plugin up to version 0.8.5 reflects UTM query parameters into popup form HTML without escaping them, which can lead to Reflected XSS attacks.
Original NVD description (English source)
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Brave Brave brave-popup-builder allows Code Injection.This issue affects Brave: from n/a through 0.8.8.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS