CVE-2026-15297: Brevo WordPress Plugin XSS Vulnerability

CVE-2026-15297 Overview

CVE-2026-15297 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Newsletter, SMTP, Email marketing and Subscribe forms by Brevo (formerly Sendinblue) plugin for WordPress. The flaw affects all plugin versions up to and including 3.1.77. It exists in the handling of the page parameter due to insufficient input sanitization and output escaping [CWE-79]. Unauthenticated attackers can craft URLs containing malicious JavaScript that executes in a victim's browser when the victim clicks the link. Successful exploitation allows session hijacking, credential theft, and administrative actions performed under the victim's authenticated context.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in an administrator's browser, enabling account takeover through a single malicious link.

Affected Products

Brevo (formerly Sendinblue) Newsletter, SMTP, Email marketing and Subscribe forms plugin for WordPress
All versions up to and including 3.1.77
WordPress sites with the vulnerable mailin plugin installed and activated

Discovery Timeline

2026-07-10 - CVE-2026-15297 published to the National Vulnerability Database (NVD)
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-15297

Vulnerability Analysis

The vulnerability resides in the plugin's administrative table forms handler, specifically at inc/table-forms.php around line 102. The plugin reads the HTTP page query parameter and reflects it into rendered HTML output without applying proper sanitization or escaping. Because the value is echoed inside an HTML context, an attacker-controlled payload is parsed by the browser as executable script. The issue is classified under [CWE-79] Improper Neutralization of Input During Web Page Generation.

The attack requires user interaction. A victim must click a crafted link that carries the payload in the page parameter. When the victim is an authenticated WordPress administrator, the injected script runs with the victim's session privileges. The vulnerability has a scope change characteristic, meaning the injected code executes in a security context different from the vulnerable component.

Root Cause

The plugin fails to call WordPress escaping functions such as esc_attr(), esc_html(), or sanitize_text_field() on the page request parameter before writing it to the response. This omission allows raw HTML and JavaScript characters to pass through unchanged. Reviewers can inspect the pre-patch code at the WordPress Plugin Code Review reference.

Attack Vector

An attacker constructs a URL targeting the vulnerable admin page and appends a malicious page parameter containing JavaScript. The attacker then delivers the URL through phishing email, forum posts, or social media. When a logged-in WordPress user, particularly an administrator, follows the link, their browser executes the injected script under the target site's origin. The script can exfiltrate cookies, forge authenticated requests to create rogue administrator accounts, or inject persistent backdoors through plugin or theme editors.

No verified proof-of-concept code is available. Refer to the Wordfence Vulnerability Analysis for further technical context.

Detection Methods for CVE-2026-15297

Indicators of Compromise

HTTP GET requests to WordPress admin pages containing script tags, javascript: URIs, or event handlers such as onerror= and onload= inside the page query parameter
Unexpected creation of new WordPress administrator accounts shortly after an admin session interacts with an inbound link
Modifications to active theme or plugin files immediately following admin activity from an external referrer
Outbound requests from browsers to attacker-controlled domains carrying WordPress session cookies

Detection Strategies

Inspect web server access logs for requests to wp-admin endpoints with the page parameter containing URL-encoded HTML characters such as %3Cscript%3E, %22, or onmouseover
Deploy Web Application Firewall (WAF) rules that block reflected XSS payload patterns targeting the mailin plugin routes
Correlate admin authentication events with subsequent privileged actions to identify anomalous account creation or file edits

Monitoring Recommendations

Forward WordPress audit logs and web server logs into a centralized data lake or SIEM for query-based hunting on the page parameter
Monitor endpoints used by administrators for browser process behavior that indicates script-driven credential theft
Alert on changes to WordPress user roles, capability grants, and plugin files where the initiating request contains suspicious query strings

How to Mitigate CVE-2026-15297

Immediate Actions Required

Update the Brevo (Sendinblue) Newsletter plugin to a version later than 3.1.77 as soon as the patched release is available
Restrict administrative access to trusted networks using IP allow-listing at the web server or WAF layer
Instruct WordPress administrators to avoid clicking untrusted links while authenticated to the site
Rotate WordPress administrator passwords and invalidate active sessions if suspicious admin URLs appear in logs

Patch Information

The plugin maintainers addressed the flaw in the source tree referenced by the WordPress Changeset Update. The fix introduces proper escaping on the reflected page parameter. Administrators should upgrade through the WordPress plugin management console and verify the installed version is greater than 3.1.77.

Workarounds

Deactivate and remove the Brevo Newsletter plugin until the patched release is deployed
Deploy a virtual patch through a WAF that blocks requests where the page parameter contains angle brackets, quotes, or JavaScript event handler keywords
Enforce a strict Content Security Policy (CSP) that disallows inline script execution on WordPress admin pages
Require re-authentication for sensitive administrative actions to limit the impact of hijacked sessions

bash

# Example WAF rule (ModSecurity) blocking reflected XSS in the page parameter
SecRule ARGS:page "@rx (?i)(<script|javascript:|onerror=|onload=|onmouseover=)" \
    "id:1015297,phase:2,deny,status:403,log,\
     msg:'Blocked reflected XSS attempt against Brevo plugin (CVE-2026-15297)'"