CVE-2026-81571 Details
Description
The Brave WordPress plugin before 0.8.8 does not prevent a URL parameter used to pre-fill a form field from being passed to WordPress's shortcode engine, allowing unauthenticated attackers to have arbitrary shortcodes registered on the site executed server-side.
A vulnerability in the Brave WordPress plugin, affecting versions prior to 0.8.8, allows unauthenticated attackers to execute arbitrary shortcodes on the server side. This issue arises because the plugin does not properly sanitize a URL parameter used to pre-fill form fields, allowing the parameter to be passed directly to WordPress's shortcode engine. Exploitation requires the presence of a published popup containing a hidden form field set to receive its default value from a URL parameter.
Users are advised to update the Brave WordPress plugin to version 0.8.8 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 2, 2026CISA-ADP
Assessed Sep 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wpscan.com/vulnerability/049d0bfc-962b-4f5b-a089-c45f4ad981e3/ | [email protected] | AdvisoryExploitRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Brave Popup Builder | < 0.8.8 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 2, 2026 | New CVE Received | [email protected] |
| Sep 2, 2026 | CVE Modified | CISA-ADP |