CVE-2026-15648 Overview
CVE-2026-15648 is a Stored Cross-Site Scripting (XSS) vulnerability in the Brands for WooCommerce plugin for WordPress. The flaw affects all versions up to and including 3.8.8 and stems from insufficient input sanitization and output escaping on the width attribute of a Divi shortcode. Authenticated users with contributor-level access or higher can inject arbitrary JavaScript that executes in the browser of any visitor viewing the affected page. The issue is tracked under [CWE-79] and has an EPSS score of 0.193%.
Critical Impact
Contributor-level attackers can persist malicious JavaScript in WooCommerce pages, enabling session theft, administrative action forgery, and drive-by redirection for every visitor who loads the page.
Affected Products
- Brands for WooCommerce plugin for WordPress
- All versions up to and including 3.8.8
- Divi shortcode integration component (addons/divi_shortcode/divi-builder.php)
Discovery Timeline
- 2026-07-24 - CVE-2026-15648 published to NVD
- 2026-07-24 - Last updated in NVD database
Technical Details for CVE-2026-15648
Vulnerability Analysis
The Brands for WooCommerce plugin ships a Divi Builder integration that registers a shortcode for rendering brand listings. The shortcode accepts a width attribute intended to control the display size of brand elements. The plugin passes this attribute value into rendered HTML output without applying escaping functions such as esc_attr() or esc_html(). An authenticated contributor can embed the shortcode in a post or page and supply a width value that breaks out of the attribute context and introduces script content. The payload persists in the database and executes for every user who subsequently renders the page, including administrators.
Root Cause
The root cause is missing input sanitization and output escaping on shortcode attribute values within the Divi builder integration file located at addons/divi_shortcode/divi-builder.php. WordPress requires shortcode attribute values to be validated against expected types and escaped on output when interpolated into HTML. The affected code paths at lines 7, 16, and 127 of the plugin source concatenate the width attribute into HTML without applying escaping, permitting attribute-context injection [CWE-79].
Attack Vector
Exploitation requires network access to the WordPress site and authenticated contributor-level privileges. The attacker creates or edits content that embeds the vulnerable shortcode and supplies a crafted width value containing JavaScript payload delimiters. When the page is published or previewed by any user, the browser parses the injected script within the trusted origin of the WordPress site. Because the scope changes to affect other users' sessions, an attacker can escalate privileges by capturing administrator session cookies or forging privileged requests. Refer to the WordPress Plugin Code Review for the affected source location.
Detection Methods for CVE-2026-15648
Indicators of Compromise
- Post or page content in the WordPress database containing Brands for WooCommerce shortcodes with width attribute values that include <, >, ", ', or javascript: sequences.
- Unexpected outbound requests from visitor browsers to attacker-controlled domains after loading brand pages.
- New administrator accounts, plugin installations, or option changes originating shortly after contributor-authored content is viewed by an admin.
Detection Strategies
- Query the wp_posts table for post_content entries referencing the Brands for WooCommerce Divi shortcode and inspect the width parameter for non-numeric values.
- Monitor web server access logs for requests to pages containing the vulnerable shortcode paired with anomalous referrers or outbound script beacons.
- Review contributor and author accounts for recently edited or newly created posts that embed unfamiliar shortcode attributes.
Monitoring Recommendations
- Deploy a Content Security Policy (CSP) with a strict script-src directive to surface inline script violations for stored XSS payloads.
- Enable WordPress audit logging to capture post creation, revision, and shortcode usage events by contributor-role users.
- Forward WordPress and web server logs to a centralized platform for correlation across authentication, content editing, and outbound traffic events.
How to Mitigate CVE-2026-15648
Immediate Actions Required
- Update the Brands for WooCommerce plugin to a version newer than 3.8.8 that includes the fix referenced in the WordPress Plugin Change Set.
- Audit existing posts and pages for injected width attribute payloads and sanitize or remove any suspicious content.
- Review contributor-level and higher accounts, rotating credentials for any that show unexpected activity.
Patch Information
The vendor addressed the issue in a release following version 3.8.8. The corresponding fix commit is documented in the WordPress plugin repository changeset 3608899. Consult the Wordfence Vulnerability Report for detailed remediation guidance and the fixed version identifier.
Workarounds
- Restrict contributor and author role assignments to trusted users until the plugin is upgraded.
- Temporarily deactivate the Brands for WooCommerce plugin if it is not actively required for site operations.
- Apply a web application firewall rule that blocks requests containing shortcode parameters with HTML metacharacters such as <, >, and quotation marks.
- Enforce a Content Security Policy that disallows inline scripts to reduce the impact of stored payloads on visitors.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
