Description

Brave Popup Builder (brave-popup-builder) up to version 0.8.5 reflects UTM query parameters into popup form HTML without escaping them.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-23T06:17:27.730Z",
  "pubdate": "2026-08-23T06:17:27.730Z",
  "executiveSummary": "A reflected cross-site scripting vulnerability has been identified in the Brave Popup Builder (brave-popup-builder) plugin up to version 0.8.5. The security defect arises due to the direct reflection of UTM query parameters into the generated popup form HTML without undergoing proper contextual output encoding or sanitization. This flaw permits unauthenticated remote attackers to craft malicious HTTP request URLs containing arbitrary script payloads and induce users into clicking them.\nUpon successful exploitation, the injected malicious script executes within the security context of the victim's browser session interacting with the vulnerable WordPress site. This can lead to unauthorized access to sensitive session tokens, cookie theft, manipulation of the Document Object Model (DOM), and redirection to malicious external domains. Given the nature of popup builder components, successful payload execution may also allow attackers to deface site content or capture sensitive user input submitted through rendered forms. Risk implications remain high for sites utilizing affected versions of the software exposed to the public internet, as the vulnerability requires no special privileges or authentication for exploitation beyond social engineering techniques to deliver the crafted payload link to the target.",
  "technicalDetails": "The vulnerability resides in the input handling and output rendering mechanisms of the Brave Popup Builder (brave-popup-builder) plugin up to version 0.8.5. The root cause of the flaw is improper output neutralization, specifically the failure to apply robust context-aware escaping mechanisms to dynamic query string parameters—namely UTM parameters—before embedding them directly into the Hypertext Markup Language (HTML) structure of popup forms.\nThe attack flow proceeds as follows: An attacker crafts a specialized Uniform Resource Locator (URL) targeting a site running the vulnerable Brave Popup Builder plugin, appending malicious JavaScript payloads within the standard UTM query parameters (e.g., utm_source, utm_medium, utm_campaign). When a victimized user navigates to this crafted URL, the web application processes the incoming HTTP request and passes the unvalidated query parameter values into the plugin's form generation routines. Because the application fails to sanitize or encode these inputs prior to rendering, the raw payload is written directly into the Document Object Model (DOM) of the response page within the context of the popup form HTML.\nWhen the browser parses the response, it interprets the unescaped input as executable code rather than passive text content. The injected script payload subsequently executes within the user's browser session, inheriting the origin privileges associated with the vulnerable domain. This grants the attacker the ability to execute arbitrary client-side JavaScript, access document.cookie, perform DOM-based actions, or exfiltrate session data to external attacker-controlled infrastructure. Network exposure is external, requiring HTTP/HTTPS access to the vulnerable WordPress installation. The vulnerability can be exploited by unauthenticated remote attackers with zero privilege requirements, relying solely on standard web requests and a delivery vector such as phishing to induce user interaction with the malicious link."
}