What is the CVSS score of CVE-2026-15648?

CVE-2026-15648 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Brands for WooCommerce CVE-2026-15648

EUVD-2026-48508 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-24 Wordfence

GHSA-36xv-3m2q-wwfm

WordPress XSS Wordpress Plugin Brands For Woocommerce Berocket

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

UI:R corrects the official vector - stored XSS payload fires only when a victim visits the injected page, requiring user interaction.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 07:53 vuln.today

CVE Published

Jul 24, 2026 - 06:52 cve.org

MEDIUM 6.4

DescriptionCVE.org

The Brands for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'width' Shortcode Attribute in all versions up to, and including, 3.8.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the Brands for WooCommerce WordPress plugin (versions up to and including 3.8.8) allows authenticated attackers holding contributor-level access or higher to inject persistent malicious scripts via an unsanitized 'width' shortcode attribute in the Divi Builder integration. The payload executes in the browser of any user who subsequently visits an injected page, with scope change confirmed by CVSS S:C. No public exploit code or CISA KEV listing was identified at time of analysis.

Technical ContextAI

The vulnerability resides in the plugin's Divi Builder shortcode integration (addons/divi_shortcode/divi-builder.php), specifically where the 'width' attribute of a WooCommerce brand-display shortcode is rendered without proper sanitization or output escaping, as confirmed by source references at lines 7, 16, and 127 of that file. CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause: attacker-controlled shortcode attribute data flows into rendered HTML without sanitize_text_field() or esc_attr() processing. The affected CPE is cpe:2.3:a:berocket:brands_for_woocommerce:*:*:*:*:*:*:*:*, covering all versions through 3.8.8. Because the script is stored server-side and served to all subsequent page visitors, the impact crosses the security boundary of the injecting user's own session into other users' browser contexts, driving the CVSS scope-change classification.

RemediationAI

A patch changeset has been committed to the WordPress plugin repository (https://plugins.trac.wordpress.org/changeset?reponame=&old=3608899%40brands-for-woocommerce&new=3608899%40brands-for-woocommerce), but no specific fixed release version number was identified in the available data - the patched version should be confirmed via the WordPress plugin directory before upgrading. Site administrators should update to the latest available version of Brands for WooCommerce from the WordPress.org plugin repository immediately. As a compensating control while the patch is validated, restrict contributor-level role assignments to fully trusted users only, since that is the minimum privilege required for exploitation. Alternatively, temporarily disabling the Divi Builder shortcode addon within the plugin eliminates the vulnerable code path with the trade-off of losing Divi-integrated brand display functionality.