CVE-2026-77115

Brave Popup Builder (brave-popup-builder), a WordPress plugin, is vulnerable to unauthenticated reflected XSS in versions up to 0.8.5 . The root cause is that UTM query parameters are reflected into the popup form HTML without proper escaping, allowing an attacker to inject arbitrary JavaScript v...

EUVD-2026-64638

Brave Popup Builder brave-popup-builder up to version 0.8.5 reflects UTM query parameters into popup form HTML without escaping them...