CVE-2026-15647 in Brands for WooCommerce Plugin
Summary
by MITRE • 07/23/2026
The Brands for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'br_brand_tooltip' Term Meta Field in all versions up to, and including, 3.8.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Because the payload is stored in term meta rather than post content, the WordPress unfiltered_html capability exception does not apply, meaning Shop Manager-level users — who normally lack unfiltered_html — can fully exploit this vulnerability.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/23/2026
The Brands for WooCommerce plugin presents a critical stored cross-site scripting vulnerability that affects all versions up to and including 3.8.8, representing a significant security risk for WordPress e-commerce environments. This vulnerability stems from inadequate input sanitization and output escaping mechanisms within the plugin's handling of the 'br_brand_tooltip' term meta field, creating an exploitable condition that allows malicious actors to inject persistent malicious scripts into the plugin's metadata storage system.
The technical flaw manifests in how the plugin processes and stores term meta data without proper validation or sanitization of user inputs. When attackers with custom-level access or higher submit malicious payloads through the brand tooltip functionality, these scripts are stored in the WordPress term meta database entries rather than in regular post content. This storage mechanism is particularly dangerous because it bypasses the standard WordPress security restrictions that typically protect against script injection in post content, since term meta fields are not subject to the same sanitization rules as traditional post content.
The operational impact of this vulnerability extends beyond typical XSS scenarios due to the specific privilege requirements and execution environment. Attackers need only custom-level access or higher to exploit this weakness, which includes Shop Manager-level users who normally do not possess the unfiltered_html capability that would typically allow them to inject malicious scripts into posts. This makes the vulnerability particularly concerning because it effectively extends the attack surface to include users who should normally be restricted from executing arbitrary code within the WordPress environment, thereby undermining the privilege separation mechanisms that are fundamental to WordPress security architecture.
The exploitation of this vulnerability allows attackers to execute persistent malicious scripts whenever any user accesses pages containing the injected content, potentially leading to session hijacking, data exfiltration, or further compromise of the affected WordPress installation. This stored XSS vulnerability particularly affects WooCommerce stores where brand management functionality is actively used, as the tooltip field serves as a direct injection point that can be leveraged to target administrators and other users who interact with brand information pages.
Organizations should implement immediate mitigations including updating to the latest plugin version where this vulnerability has been addressed, implementing additional input validation measures at the WordPress level, and restricting unnecessary administrative privileges for users who do not require full access to brand management features. Security monitoring should focus on detecting unauthorized modifications to term meta fields, particularly in brand-related taxonomy terms, while network traffic analysis can help identify potential exploitation attempts through suspicious payload injection patterns. This vulnerability aligns with CWE-79 (Cross-site Scripting) and represents a specific implementation weakness that violates the principle of least privilege and proper input sanitization practices mandated by security standards such as OWASP Top Ten and NIST cybersecurity frameworks, making it a critical concern for organizations maintaining WordPress-based e-commerce platforms.