Description

The Brands for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'br_brand_tooltip' Term Meta Field in all versions up to, and including, 3.8.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Because the payload is stored in term meta rather than post content, the WordPress unfiltered_html capability exception does not apply, meaning Shop Manager-level users — who normally lack unfiltered_html — can fully exploit this vulnerability.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.4",
  "pubDate": "2026-07-23T10:16:50.943Z",
  "pubdate": "2026-07-23T10:16:50.943Z",
  "executiveSummary": "The Brands for WooCommerce WordPress plugin is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability affecting all versions up to and including 3.8.8. This security flaw stems from inadequate input sanitization and output escaping mechanisms applied to the 'br_brand_tooltip' term meta field. Consequently, authenticated malicious actors possessing custom-level access and above can inject arbitrary web scripts and malicious payloads into the application. These injected scripts subsequently execute within the context of a victim's browser session whenever they access a page rendering the compromised component.\nThe risk implication is significant as the attack vector resides within term metadata rather than standard post content. As a direct result of this architectural distinction, the default WordPress unfiltered_html capability exception does not apply. This allows lower-privileged roles, specifically Shop Manager-level users who typically lack unfiltered_html privileges, to fully exploit the vulnerability and execute arbitrary scripts.\nSuccessful exploitation requires authenticated access to the WordPress administrative dashboard with sufficient privileges to modify term metadata. Mitigation requires updating the Brands for WooCommerce plugin to a secured version once available, implementing rigorous input sanitization, and enforcing context-aware output encoding across all term meta fields.",
  "technicalDetails": "The vulnerability is classified as Stored Cross-Site Scripting (XSS), localized within the 'br_brand_tooltip' term meta field of the Brands for WooCommerce plugin. The root cause of the flaw is insufficient input sanitization during data ingestion and a total lack of proper context-aware output escaping when the term metadata is retrieved and rendered to the user interface. Because input filtering is missing or bypassed, arbitrary HTML and JavaScript payloads can be successfully written to the database.\nThe vulnerable component handles brand-related taxonomy metadata within the WordPress database. Specifically, the 'br_brand_tooltip' field fails to validate or sanitize user-supplied data before persistence. When an authenticated user with custom-level access or above submits a crafted payload into the vulnerable term meta field, the database stores the malicious script without interference.\nUnlike standard post content where the unfiltered_html capability restricts lower-privileged users from injecting raw scripts, term meta fields do not enforce this specific capability check in the same manner. Consequently, Shop Manager-level users—who normally lack the unfiltered_html capability required to inject scripts into posts—are fully capable of exploiting this vulnerability by interacting with product brand terms and their corresponding tooltips.\nThe attack flow proceeds as follows: First, an attacker with Shop Manager-level access or higher navigates to the brand management interface within the WordPress administration panel. Second, the attacker supplies a crafted payload containing malicious JavaScript within the 'br_brand_tooltip' term meta field and submits the update. Third, the application stores the unsanitized payload directly in the database. Fourth, when any user subsequently visits a frontend or backend page where the affected brand tooltip is rendered, the server outputs the raw payload into the Document Object Model (DOM). Finally, the victim's browser executes the script within their session context, potentially leading to session hijacking, administrative privilege escalation, or unauthorized actions performed on behalf of the victim."
}