55 matches found
CVE-2026-81571 Brave Popup Builder < 0.8.8 - Unauthenticated Arbitrary Shortcode Execution via UTM Parameter
The Brave WordPress plugin before 0.8.8 does not prevent a URL parameter used to pre-fill a form field from being passed to WordPress's shortcode engine, allowing unauthenticated attackers to have arbitrary shortcodes registered on the site executed server-side...
CVE-2026-77116
Brave Popup Builder slug: brave-popup-builder has a broken access control issue in versions through 0.8.5. Any logged-in user - Subscriber or WooCommerce Customer is enough — can read popup content they shouldn't have access to by passing a post ID in the URL...
CVE-2026-77115
Brave Popup Builder brave-popup-builder up to version 0.8.5 reflects UTM query parameters into popup form HTML without escaping them...
EUVD-2026-64639
Brave Popup Builder slug: brave-popup-builder has a broken access control issue in versions through 0.8.5. Any logged-in user - Subscriber or WooCommerce Customer is enough — can read popup content they shouldn't have access to by passing a post ID in the URL...
EUVD-2026-64638
Brave Popup Builder brave-popup-builder up to version 0.8.5 reflects UTM query parameters into popup form HTML without escaping them...
CVE-2026-77115
The Brave Popup Builder (brave-popup-builder) WordPress plugin, versions
CVE-2026-77116
The Brave Popup Builder WordPress plugin (slug: brave-popup-builder ) is vulnerable to a broken access control issue in versions through 0.8.5 . An authenticated user with Subscriber or WooCommerce Customer privileges can read restricted popup content by providing a specific post ID in the URL. T...
CVE-2026-77115 Brave Popup Builder < 0.8.6 - Unauthenticated Reflected XSS via UTM Parameters
Brave Popup Builder brave-popup-builder up to version 0.8.5 reflects UTM query parameters into popup form HTML without escaping them...
CVE-2026-77115 Brave Popup Builder < 0.8.6 - Unauthenticated Reflected XSS via UTM Parameters
Brave Popup Builder brave-popup-builder up to version 0.8.5 reflects UTM query parameters into popup form HTML without escaping them...
CVE-2026-77116 Brave Popup Builder < 0.8.6 - Subscriber+ Unpublished Popup Disclosure via Preview
Brave Popup Builder slug: brave-popup-builder has a broken access control issue in versions through 0.8.5. Any logged-in user - Subscriber or WooCommerce Customer is enough — can read popup content they shouldn't have access to by passing a post ID in the URL...
CVE-2026-77116 Brave Popup Builder < 0.8.6 - Subscriber+ Unpublished Popup Disclosure via Preview
Brave Popup Builder slug: brave-popup-builder has a broken access control issue in versions through 0.8.5. Any logged-in user - Subscriber or WooCommerce Customer is enough — can read popup content they shouldn't have access to by passing a post ID in the URL...
PT-2026-79763
Brave Popup Builder slug: brave-popup-builder has a broken access control issue in versions through 0.8.5. Any logged-in user - Subscriber or WooCommerce Customer is enough — can read popup content they shouldn't have access to by passing a post ID in the URL...
CVE-2026-77115: Improper Neutralization of Input During Web Page Generation
Brave Popup Builder brave-popup-builder up to version 0.8.5 reflects UTM query parameters into popup form HTML without escaping them...
CVE-2026-77116: Authorization Bypass Through User-Controlled Key
Brave Popup Builder slug: brave-popup-builder has a broken access control issue in versions through 0.8.5. Any logged-in user - Subscriber or WooCommerce Customer is enough — can read popup content they shouldn't have access to by passing a post ID in the URL...
PT-2026-79762
Brave Popup Builder brave-popup-builder up to version 0.8.5 reflects UTM query parameters into popup form HTML without escaping them...
CVE-2025-68508
Missing Authorization vulnerability in Brave Brave brave-popup-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Brave: from n/a through = 0.8.3...
CVE-2025-68508
CVE-2025-68508 affects the WordPress Brave plugin’s brave-popup-builder component (Brave Brave plugin) up to version 0.8.3. The root cause is missing/incorrect authorization due to misconfigured access control levels, enabling a broken access control vulnerability. Reported details across multipl...
CVE-2025-68508: Missing Authorization
Missing Authorization vulnerability in Brave Brave brave-popup-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Brave: from n/a through = 0.8.3...