CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionNVD
The Brandfolder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 5.0.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting (XSS) in the Brandfolder WordPress plugin up to version 5.0.19 allows authenticated attackers with Contributor-level permissions or above to inject arbitrary JavaScript via the 'id' parameter, which executes in the browser context of any user accessing the affected page. The vulnerability stems from insufficient input sanitization and output escaping. No public exploit code or active exploitation has been confirmed at the time of analysis; however, the low attack complexity and requirement only for Contributor-level authentication make this a practical risk in multi-user WordPress environments. A patched version (5.0.20) is available from the vendor.
Technical ContextAI
The Brandfolder plugin integrates third-party asset management functionality into WordPress. The vulnerability exists in the 'id' parameter handling within the brandfolder-integration.php file (confirmed at line 138 in both vulnerable 5.0.19 and patched 5.0.20 versions per the code repository references). The root cause is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic Stored XSS weakness where user-supplied input is stored in the database and later rendered to the page without proper HTML entity encoding or JavaScript escaping. Because the flaw is in output rendering rather than input validation alone, attackers can craft payloads that bypass simple sanitization checks. The vulnerability affects WordPress installations where the plugin is active and users with Contributor role or higher (Editor, Administrator) have the ability to create or modify content containing the vulnerable parameter.
Affected ProductsAI
The Brandfolder WordPress plugin versions up to and including 5.0.19 are affected. The plugin is distributed via the official WordPress plugin repository (wordpress.org/plugins/brandfolder). Vulnerability details and affected code are documented in the WordPress plugin trac system at plugins.trac.wordpress.org/browser/brandfolder. All installations of the plugin with version 5.0.19 or earlier require immediate patching. Version 5.0.20 contains the fix and is confirmed available in the referenced trac repository.
RemediationAI
Update the Brandfolder plugin to version 5.0.20 or later immediately via the WordPress plugin dashboard (Plugins > Updates) or manually download from wordpress.org/plugins/brandfolder. Administrators should verify that only trusted users have Contributor-level or higher roles, as any such user can inject XSS until the patch is applied. As a temporary workaround pending patch deployment, restrict Contributor-level access to users who require it; however, this is not a substitute for patching. Review audit logs and page content for suspicious 'id' parameter values or injected script tags in posts/pages created by Contributor-level users during the vulnerability window. Additional details and security guidance are available in the Wordfence threat intelligence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/bedbe508-e879-4989-89a6-db909ecd35a8?source=cve).
Share
External POC / Exploit Code
Leaving vuln.today