Description

The Brands for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and including, 3.8.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-07-23T10:16:50.817Z",
  "pubdate": "2026-07-23T10:16:50.817Z",
  "executiveSummary": "The Brands for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'style' shortcode attribute in all versions up to, and including, 3.8.8. This security defect arises due to insufficient input sanitization and output escaping mechanisms applied to user-supplied attribute values processed by the application.\nThe vulnerability enables authenticated attackers possessing contributor-level access and above to inject arbitrary web scripts, such as malicious JavaScript payloads, directly into the database. When an unsuspecting user accesses a crafted page containing the vulnerable shortcode, the injected script executes within the context of their browser session.\nThe primary risk implication involves session hijacking, unauthorized administrative action execution, and potential defacement or redirection of affected pages. Successful exploitation requires authenticated access with a minimum privilege level of a contributor, meaning an attacker must first compromise or provision an account with adequate posting permissions within the WordPress environment.",
  "technicalDetails": "The vulnerability stems from inadequate handling of user-controlled input within the shortcode parsing logic of the Brands for WooCommerce plugin. Specifically, the 'style' attribute exposed by the shortcode fails to properly sanitize input data and lacks contextual output escaping before rendering the content back to the Document Object Model (DOM).\nBecause the application accepts raw or insufficiently filtered input strings into the 'style' attribute, an authenticated user with contributor-level privileges or higher can craft a malicious post or page containing the affected shortcode injected with arbitrary script payloads, such as HTML event handlers or script tags designed to bypass basic filters.\nThe step-by-step attack flow proceeds as follows: First, the authenticated attacker creates or edits a post or page within the WordPress dashboard, inserting the Brands for WooCommerce shortcode with a maliciously crafted 'style' attribute containing executable JavaScript. Second, the vulnerable plugin processes the shortcode parameters and writes the unsanitized input directly into the WordPress database as part of the post content without validating or neutralizing dangerous characters.\nThird, when a victimized user or administrator requests the rendered page, the server retrieves the stored post content and outputs the malicious shortcode rendering directly into the HTTP response body without proper encoding. Fourth, the victim's browser parses the HTML response, interprets the injected payload as legitimate script execution due to the lack of output escaping, and executes the arbitrary JavaScript within the security context of the victim's active session.\nThe vulnerable component is the shortcode parsing and rendering engine of the Brands for WooCommerce plugin, specifically affecting all versions up to, and including, 3.8.8. The attack vector is localized within the web application layer, requiring network access to the WordPress administrative or publishing interface. The necessary prerequisites for exploitation include network exposure of the WordPress instance and possession of authenticated credentials with a minimum privilege level of a contributor."
}