Brave Popup Builder CVE-2026-48202

Exploitation requires reaching an input path in the brave-popup-builder WordPress plugin (version through 0.8.8) that improperly neutralizes script-related HTML tags, and a victim subsequently rendering the affected page so the injected markup executes. The supplied vector lists PR:N/UI:N, which would imply unauthenticated injection with no interaction; however, the specific feature, endpoint, or configuration that triggers the flaw is not described in the available sources, and for a Basic XSS (CWE-80) a victim normally must load the page for impact to occur. Limiting factors: the plugin must be installed and active, and the vulnerable input path must be exposed - the exact privilege level is not confirmed from the input.

This is a moderate-severity, low-priority issue rather than an emergency. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3) describes network-reachable, low-complexity access with no privileges and only a limited confidentiality impact. No EPSS score was provided, the CVE is NOT on CISA KEV, and no verified working exploit code is referenced - the only reference is a Patchstack advisory entry, so exploitation status is: no public exploit identified at time of analysis. The vuln.today decision label is 'this_month', consistent with a non-urgent but real patch item. Note a conflict worth flagging: the CWE (CWE-80, Basic XSS) and the Patchstack title ('content injection') describe a cross-site scripting flaw, yet the supplied vector sets UI:N and S:U with only C:L and I:N - unusual for XSS, where a victim normally must render the injected markup (UI:R) and script execution in the victim context typically implies a scope change and an integrity impact. The trigger is not described in the available sources, so the exact privilege/interaction prerequisites cannot be confirmed from the input. Treat this as a standard WordPress-plugin XSS to be patched on a routine cycle, not a widespread-exploitation priority.

An attacker supplies crafted input containing script-related HTML tags to a brave-popup-builder field or endpoint that fails to neutralize it (CWE-80), so the markup is stored or reflected and later executes in a browser rendering the affected page. Running in the victim's session, the script could read limited session data (consistent with C:L) such as cookies or tokens. The exact injection point and whether authentication is required are not described in the available sources, and no verified working exploit code is referenced.