Brands for WooCommerce vulnerabilities
3 known CVE vulnerabilities in Brands for WooCommerce, translated and rated.
- CVE-2026-15648Medium
The Brands for WooCommerce plugin for WordPress is vulnerable to Stored XSS via the 'width' Shortcode Attribute due to insufficient input sanitization. Attackers with contributor-level access can inject arbitrary scripts.
- CVE-2026-15647Medium
The Brands for WooCommerce plugin for WordPress up to version 3.8.8 is vulnerable to Stored Cross-Site Scripting via the 'br_brand_tooltip' Term Meta field. Insufficient input sanitization and output escaping allow authenticated attackers with custom-level access and above to inject arbitrary scripts that execute on every page visit. Even Shop Manager users (without unfiltered_html) can exploit this.
- CVE-2026-15646Medium
The Brands for WooCommerce plugin for WordPress up to version 3.8.8 has a Stored XSS vulnerability in the 'style' shortcode attribute. Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject scripts.