CVE-2026-48202: WordPress Brave plugin <= 0.8.8 - Content Injection vulnerability

Q: Who can exploit this issue?

The CVSS vector indicates that exploitation is network-accessible, requires no privileges or user interaction, and has low attack complexity. An unauthenticated remote attacker could attempt to exploit an affected installation.

Q: What is the impact if exploitation succeeds?

The reported impact is limited to confidentiality, with no integrity or availability impact indicated. The issue is categorized as basic cross-site scripting/content injection and code injection.

Q: Which versions are affected?

Brave versions through 0.8.8 are affected. The available data does not identify a fixed version.

Published Oct 29, 2026

Updated

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Brave Brave brave-popup-builder allows Code Injection.This issue affects Brave: from n/a through 0.8.8.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Brave plugin to a version that resolves this vulnerability.
Fixed in 0.8.9

Frequently Asked Questions

Who can exploit this issue?

The CVSS vector indicates that exploitation is network-accessible, requires no privileges or user interaction, and has low attack complexity. An unauthenticated remote attacker could attempt to exploit an affected installation.

What is the impact if exploitation succeeds?

The reported impact is limited to confidentiality, with no integrity or availability impact indicated. The issue is categorized as basic cross-site scripting/content injection and code injection.

Which versions are affected?