CVE-2026-15648 in Brands for WooCommerce Plugin
Summary
by MITRE • 07/24/2026
The Brands for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'width' Shortcode Attribute in all versions up to, and including, 3.8.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/25/2026
The Brands for WooCommerce plugin presents a critical stored cross-site scripting vulnerability that affects all versions up to and including 3.8.8, creating a significant security risk for WordPress installations. This vulnerability stems from inadequate input sanitization and output escaping mechanisms within the plugin's shortcode implementation, specifically when processing the 'width' attribute. The flaw allows authenticated attackers who possess contributor-level access or higher privileges to inject malicious scripts that persist in the application's database and execute whenever affected pages are accessed by other users.
The technical nature of this vulnerability places it firmly within the CWE-79 category of Cross-Site Scripting, which represents one of the most prevalent and dangerous web application security flaws. The attack vector exploits the plugin's failure to properly sanitize user-supplied input before storing it in the database, combined with insufficient output escaping when rendering the stored content. This combination creates a persistent XSS condition where malicious scripts can be executed in the context of any user who views pages containing the injected content, potentially leading to session hijacking, credential theft, or further compromise of the affected WordPress installation.
The operational impact of this vulnerability extends beyond simple script execution, as it enables attackers to leverage the elevated privileges of contributors to establish persistent footholds within WordPress environments. Contributors typically have access to modify posts, pages, and media files, making them capable of injecting malicious code that can be executed by other users with varying privilege levels. The stored nature of this vulnerability means that once injected, the malicious scripts remain active until manually removed from the database, potentially affecting all users who access pages containing the compromised shortcode attributes. This persistent threat can facilitate more sophisticated attacks including data exfiltration, malware distribution, or the establishment of backdoors within the WordPress environment.
Security practitioners should implement immediate mitigations including updating to the latest plugin version where the vulnerability has been patched, implementing proper input validation and output escaping mechanisms, and monitoring for suspicious user activities related to shortcode usage. Additionally, organizations should consider implementing web application firewalls, restricting contributor privileges where possible, and conducting regular security audits of installed plugins to identify similar vulnerabilities. The ATT&CK framework categorizes this as a technique involving 'Web Shell' and 'Command and Scripting Interpreter' tactics, highlighting the potential for attackers to escalate privileges and maintain persistent access through such vector exploitation. Organizations relying on WooCommerce brands functionality should prioritize patch management and conduct comprehensive security assessments of their WordPress environments to prevent exploitation of this stored XSS vulnerability.