CVE-2026-77115: Brave Popup Builder XSS Vulnerability

CVE-2026-77115 Overview

CVE-2026-77115 is a reflected Cross-Site Scripting (XSS) vulnerability in the Brave Popup Builder (brave-popup-builder) WordPress plugin through version 0.8.5. The plugin reflects UTM query parameters into popup form HTML without escaping them, allowing attackers to inject arbitrary JavaScript that executes in the victim's browser session. The flaw is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Attackers can craft malicious URLs containing UTM parameters that execute arbitrary JavaScript when visited, enabling session hijacking, credential theft, and defacement on affected WordPress sites.

Affected Products

Brave Popup Builder (brave-popup-builder) WordPress plugin
All versions up to and including 0.8.5
WordPress sites deploying the plugin with unsanitized UTM tracking

Discovery Timeline

2026-08-23 - CVE-2026-77115 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-77115

Vulnerability Analysis

The Brave Popup Builder plugin captures UTM query parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content) from incoming requests and embeds their values directly into popup form HTML. The plugin fails to apply output escaping such as esc_attr() or esc_html() before rendering these values into the DOM.

An attacker crafts a URL containing JavaScript payloads in one or more UTM parameters. When a victim clicks the link, the plugin reflects the payload into the rendered popup markup, and the browser executes it in the site's origin. This grants the attacker access to cookies, session tokens, and any authenticated actions available to the victim.

Because exploitation requires user interaction and the injected script runs in the context of another origin, the impact scope is changed but limited to confidentiality, integrity, and availability effects tied to the victim's browser session.

Root Cause

The root cause is missing output encoding of user-controlled query string data before insertion into HTML form attributes. The plugin trusts UTM values as tracking metadata rather than treating them as untrusted input requiring sanitization.

Attack Vector

The attack is network-based and requires a victim to click a crafted link or visit an attacker-controlled page that redirects to the vulnerable WordPress site with malicious UTM parameters. The injected script executes with the privileges of the visiting user, including administrators if targeted through social engineering.

The vulnerability manifests during server-side rendering of the popup form. See the WPScan Vulnerability Report for technical details on the injection point and proof-of-concept payloads.

Detection Methods for CVE-2026-77115

Indicators of Compromise

HTTP requests to WordPress pages containing UTM parameters with HTML tags, JavaScript event handlers (onerror=, onload=), or <script> fragments
Web server access logs showing URL-encoded payloads such as %3Cscript%3E within utm_source, utm_medium, or utm_campaign values
Unexpected outbound requests from user browsers to attacker-controlled domains following visits to popup-enabled pages
Anomalous JavaScript execution or DOM modifications on pages rendering the Brave Popup Builder form

Detection Strategies

Inspect WordPress access logs for UTM parameter values containing angle brackets, quotes, or JavaScript keywords
Deploy a Web Application Firewall (WAF) rule to flag reflected XSS patterns in query strings targeting /wp-content/plugins/brave-popup-builder/ paths
Run authenticated vulnerability scans against WordPress installations to identify plugin versions at or below 0.8.5

Monitoring Recommendations

Alert on HTTP 200 responses where request query strings contain script tags or JavaScript URI schemes
Monitor endpoint telemetry for browser processes spawning unexpected child processes or making unusual network connections after visiting the site
Correlate WordPress plugin inventory data with the NVD advisory to identify unpatched deployments across the estate

How to Mitigate CVE-2026-77115

Immediate Actions Required

Identify all WordPress installations running Brave Popup Builder version 0.8.5 or earlier
Disable or uninstall the plugin until a patched version is available and verified
Deploy WAF rules to strip or block HTML metacharacters in UTM query parameters

Patch Information

As of the last NVD update on 2026-08-26, no vendor patch is referenced in the advisory. Consult the WPScan Vulnerability Report for the latest fix status and monitor the plugin's WordPress.org listing for updates.

Workarounds

Remove the plugin from production sites until a fixed version is published
Enforce a strict Content Security Policy (CSP) that disallows inline scripts and restricts script sources to trusted origins
Apply WAF filtering to reject requests where UTM parameters contain <, >, ", ', or javascript: substrings
Educate marketing and campaign teams to avoid distributing links with unvalidated UTM values from untrusted sources

bash

# Example WAF/ModSecurity rule to block script payloads in UTM parameters
SecRule ARGS:utm_source|ARGS:utm_medium|ARGS:utm_campaign|ARGS:utm_term|ARGS:utm_content \
    "@rx (?i)(<script|javascript:|onerror=|onload=|<img|<svg)" \
    "id:1077115,\
     phase:2,\
     deny,\
     status:403,\
     msg:'CVE-2026-77115 Brave Popup Builder XSS payload in UTM parameter'"