CVE-2026-77115
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
The Brave Popup Builder plugin up to version 0.8.5 reflects UTM query parameters into popup form HTML without escaping them, which can lead to Reflected XSS attacks.
Risk Assessment
An attacker can inject malicious script into the popup form, which executes in the victim's browser, potentially leading to session theft or other harmful actions.
Recommendation
Update the Brave Popup Builder plugin to a version newer than 0.8.5 that includes the XSS fix.
Other vulnerabilities in Brave Popup Builder
See all- CVE-2026-48202Medium
The Brave Popup Builder WordPress plugin (Brave) through version 0.8.8 contains a Basic XSS vulnerability due to improper neutralization of script-related HTML tags. This allows code injection into the page.
- CVE-2026-77116Medium
The Brave Popup Builder plugin up to version 0.8.5 has a broken access control issue. Any logged-in user, even Subscriber or WooCommerce Customer, can read popup content they shouldn't have access to by passing a post ID in the URL.
Original NVD description (English source)
Brave Popup Builder (brave-popup-builder) up to version 0.8.5 reflects UTM query parameters into popup form HTML without escaping them.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS