CVE-2026-77115

HighCVSS 7.1

Published: 23/08/2026(UTC)Updated: 26/08/2026(UTC)Translated: 23/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.15%

4th percentile - higher than 4% of all known CVEs

Summary

The Brave Popup Builder plugin up to version 0.8.5 reflects UTM query parameters into popup form HTML without escaping them, which can lead to Reflected XSS attacks.

Risk Assessment

An attacker can inject malicious script into the popup form, which executes in the victim's browser, potentially leading to session theft or other harmful actions.

Recommendation

Update the Brave Popup Builder plugin to a version newer than 0.8.5 that includes the XSS fix.

Other vulnerabilities in Brave Popup Builder

CVE-2026-77116Medium
The Brave Popup Builder plugin up to version 0.8.5 has a broken access control issue. Any logged-in user, even Subscriber or WooCommerce Customer, can read popup content they shouldn't have access to by passing a post ID in the URL.

Original NVD description (English source)

Brave Popup Builder (brave-popup-builder) up to version 0.8.5 reflects UTM query parameters into popup form HTML without escaping them.