EUVD-2026-47924
GHSA-385g-h8q2-rpj7
Severity by source
AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Stored XSS canonically requires victim page visit (UI:R not UI:N); AC:L once Shop Manager credentials are held; PR:H reflects mandatory elevated role; S:C captures browser origin crossing.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Brands for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'br_brand_tooltip' Term Meta Field in all versions up to, and including, 3.8.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Because the payload is stored in term meta rather than post content, the WordPress unfiltered_html capability exception does not apply, meaning Shop Manager-level users - who normally lack unfiltered_html - can fully exploit this vulnerability.
AnalysisAI
Stored cross-site scripting in the BeRocket Brands for WooCommerce WordPress plugin (all versions through 3.8.8) enables authenticated Shop Manager-level users to inject persistent JavaScript via the br_brand_tooltip term meta field, executing against any visitor who loads an affected page. A notable architectural bypass is central to this flaw: because the payload is stored in WordPress term meta rather than post content, the platform's unfiltered_html capability gate - which normally prevents Shop Managers from injecting raw HTML - does not apply, granting that role unexpectedly full exploitation capability. No public exploit code and no CISA KEV listing exist at time of analysis.
Technical ContextAI
The affected component is the BeRocket Brands for WooCommerce plugin (CPE: cpe:2.3:a:berocket:brands_for_woocommerce:*:*:*:*:*:*:*:*), a WooCommerce extension that adds a brand taxonomy to product catalogues. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting), manifesting in two places: insufficient sanitization when the br_brand_tooltip value is written to term meta (likely via wp_update_term_meta, referenced at main.php line 718) and missing output escaping when the tooltip is rendered to HTML (main.php line 774, per the Trac browser references). The critical technical nuance is that WordPress applies unfiltered_html capability checks only to post and page content; term meta is a separate storage pathway not governed by that capability, meaning the plugin bears sole responsibility for sanitizing this field. The upstream fix is captured in Trac changeset 3608899.
RemediationAI
Update the Brands for WooCommerce plugin to the first release that incorporates Trac changeset 3608899 - monitor the plugin's WordPress.org page and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/89f6fa65-ef71-491e-8959-591b58d1444c for the confirmed patched version number, which was not explicitly available at time of analysis. As an interim compensating control, restrict Shop Manager and any custom roles from accessing the WooCommerce brand taxonomy edit interface by removing the relevant capability (manage_product_terms or equivalent) using a role-management plugin such as User Role Editor; note this will prevent those users from editing any brand entries and may impact store operations. Enforcing a Content Security Policy header (Content-Security-Policy: script-src 'self') on the front-end will significantly reduce the impact of any injected payloads that have already been stored, though it does not remove stored payloads and may break legitimate inline scripts. Audit br_brand_tooltip values in the database (SELECT meta_value FROM wp_termmeta WHERE meta_key='br_brand_tooltip') to identify and remove any pre-existing injected content.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today