CVE-2026-77115 PUBLISHED

Brave Popup Builder < 0.8.6 - Unauthenticated Reflected XSS via UTM Parameters

Assigner: WPScan
Reserved: 20.08.2026 Published: 23.08.2026 Updated: 23.08.2026

Brave Popup Builder (brave-popup-builder) up to version 0.8.5 reflects UTM query parameters into popup form HTML without escaping them.

Product Status

Vendor Unknown
Product Brave
Versions Default: unaffected
  • affected from 0 to 0.8.6 (excl.)

Credits

  • Huseyin Mertoglu finder
  • WPScan coordinator

References

Problem Types

  • CWE-79 Cross-Site Scripting (XSS) CWE