What is the CVSS score of CVE-2026-15646?

CVE-2026-15646 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Brands for WooCommerce CVE-2026-15646

EUVD-2026-47923 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-23 Wordfence

GHSA-v4j6-p77v-7vw8

WordPress XSS Wordpress Plugin Brands For Woocommerce Berocket

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

6.4 MEDIUM

Contributor authentication required (PR:L); stored payload auto-executes for all visitors (UI:N); cross-boundary browser impact justifies S:C with limited C/I and no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 09:49 vuln.today

CVE Published

Jul 23, 2026 - 08:34 cve.org

MEDIUM 6.4

DescriptionCVE.org

The Brands for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and including, 3.8.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the Brands for WooCommerce WordPress plugin (versions through 3.8.8) allows authenticated contributors to permanently embed arbitrary JavaScript into pages via the unsanitized 'style' shortcode attribute, executing in any visitor's browser upon page load. The scope change (S:C) in the CVSS vector confirms cross-boundary impact: the attacker operates at contributor privilege level but the payload compromises site visitors' browser sessions. A plugin trac changeset (revision 3608899) indicates an upstream fix has been committed. No public exploit or CISA KEV listing identified at time of analysis.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation) manifests here through the plugin's shortcode processing pipeline. The WordPress shortcode API passes user-supplied attribute values - specifically the 'style' attribute - through BeRocket's Brands for WooCommerce shortcode handler (includes/shortcodes.php, line 11) and rendering logic (templates/catalog.php, line 34), with a helper function implicated at berocket/includes/functions.php, line 516. The root cause is that the 'style' attribute value is interpolated into rendered HTML without wp_kses(), esc_attr(), or equivalent WordPress sanitization/escaping functions. Because WordPress contributors are permitted to use shortcodes in post content, this allows persistent payload injection. The CPE cpe:2.3:a:berocket:brands_for_woocommerce:*:*:*:*:*:*:*:* confirms the vendor as BeRocket and the affected software component as the brands_for_woocommerce plugin.

RemediationAI

Update the Brands for WooCommerce plugin immediately via the WordPress admin dashboard or WordPress CLI (wp plugin update brands-for-woocommerce). An upstream fix has been committed to the plugin's WordPress.org repository at changeset 3608899 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3608899%40brands-for-woocommerce&new=3608899%40brands-for-woocommerce); however, the specific patched release version has not been independently confirmed from the available data - verify the installed version post-update against the plugin changelog. As an interim compensating control, restrict contributor-level access to the minimum necessary set of trusted users, since exploitation requires that privilege tier. WordPress site administrators can also deploy a WAF rule targeting the 'style' shortcode attribute in post content (available via Wordfence or similar WordPress security plugins) to block injection attempts without disabling the plugin - note that aggressive WAF rules may interfere with legitimate style attribute usage. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/8fa3bcb9-df3e-4042-a28b-3d09bfebeebc should be monitored for confirmed patch version details.