CVE-2026-15647: Brands for WooCommerce XSS Vulnerability

CVE-2026-15647 Overview

CVE-2026-15647 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Brands for WooCommerce plugin for WordPress. The flaw affects all versions up to and including 3.8.8. It stems from insufficient input sanitization and output escaping on the br_brand_tooltip term meta field. Authenticated attackers with custom-level access or higher can inject arbitrary JavaScript that executes when users load an affected page. Because the payload is stored in term meta rather than post content, WordPress does not apply the unfiltered_html capability exception. This means Shop Manager users, who normally cannot inject raw HTML, can fully exploit the issue.

Critical Impact
Authenticated Shop Manager-level users can persistently inject JavaScript that runs in the browser of any visitor to an affected brand page, enabling session theft, admin action forgery, and content defacement.

Affected Products

Brands for WooCommerce plugin for WordPress, all versions through 3.8.8
WordPress sites running WooCommerce with the vulnerable plugin active
Sites that grant Shop Manager or custom roles access to brand term editing

Discovery Timeline

2026-07-23 - CVE-2026-15647 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-15647

Vulnerability Analysis

The Brands for WooCommerce plugin allows store administrators to attach descriptive metadata to brand taxonomy terms, including a tooltip stored as term meta under the br_brand_tooltip key. The plugin accepts input for this field without adequate sanitization, and later renders the value on public brand pages without proper output escaping. Attackers with permission to edit brand terms, such as Shop Managers or custom roles that inherit manage_product_terms, can save arbitrary HTML and JavaScript into this field. The payload persists in the WordPress database and executes in the browser of any visitor who loads the affected brand listing. Because term meta bypasses the standard WordPress content filtering path, the injected script runs with the full privileges of the viewing user, including administrators.

Root Cause

The root cause is missing input validation on write and missing escaping on read. The plugin stores the raw value submitted for br_brand_tooltip and later emits it into HTML output without applying esc_html, esc_attr, or wp_kses. WordPress normally strips dangerous HTML from post content when the submitting user lacks the unfiltered_html capability. That protection does not extend to term meta, so no capability check limits the payload. See the vulnerable rendering paths in the WordPress Plugin Code Reference at line 718 and line 774.

Attack Vector

An authenticated attacker with brand term editing rights navigates to the brand taxonomy editor and submits a crafted tooltip value containing a script payload such as an onerror handler on an image tag or an inline event attribute. The payload is written to wp_termmeta under the br_brand_tooltip key. When any user, including higher-privileged administrators, visits a page that renders the tooltip, the browser parses and executes the stored JavaScript in the site origin context. Attack complexity is high because the attacker needs elevated authenticated access and a victim must load the affected page.

No verified public exploit code is available. Technical details are described in the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-15647

Indicators of Compromise

Entries in the wp_termmeta table with meta_key = 'br_brand_tooltip' containing HTML tags, <script> blocks, javascript: URIs, or event handler attributes such as onerror, onload, or onclick.
Outbound requests from site visitors to unfamiliar third-party domains sourced from brand taxonomy pages.
Unexpected administrative actions performed by administrators immediately after visiting a brand page.

Detection Strategies

Query wp_termmeta for br_brand_tooltip values that contain <, >, or javascript: substrings and review each hit for injected markup.
Enable a Content Security Policy in report-only mode and monitor reports for inline script violations originating on brand pages.
Review WordPress audit logs for term meta modifications performed by Shop Manager or custom roles.

Monitoring Recommendations

Alert on any modification of brand taxonomy terms by non-administrator accounts.
Monitor web server logs for POST requests to edit-tags.php with the brand taxonomy and correlate with subsequent visitor sessions.
Track session token reuse from different IP addresses following visits to brand pages, which may indicate stolen session cookies.

How to Mitigate CVE-2026-15647

Immediate Actions Required

Update the Brands for WooCommerce plugin to a version released after 3.8.8 that addresses this issue.
Audit all existing br_brand_tooltip term meta entries and remove any values containing HTML or script content.
Rotate administrator session cookies and reset passwords for any account that may have loaded a compromised brand page.

Patch Information

The vendor released a fix in the plugin repository. Review the code changes in the WordPress Plugin Changeset. Apply the update through the WordPress plugin dashboard or WP-CLI.

Workarounds

Restrict brand taxonomy editing to trusted administrator accounts by removing manage_product_terms from Shop Manager and custom roles until the plugin is patched.
Deploy a web application firewall rule that blocks POST requests to term meta endpoints containing <script, onerror=, or javascript: patterns.
Enforce a strict Content Security Policy that disallows inline scripts on storefront pages.

bash

# Update the plugin using WP-CLI once a fixed release is available
wp plugin update brands-for-woocommerce

# Identify potentially malicious tooltip values for review
wp db query "SELECT term_id, meta_value FROM wp_termmeta \
  WHERE meta_key = 'br_brand_tooltip' \
  AND (meta_value LIKE '%<%' OR meta_value LIKE '%javascript:%');"