Medium severity · published Oct 29, 2026
CVE-2026-48202
WordPress Brave plugin <= 0.8.8 - Content Injection vulnerability
New
5.3
CVSS
–
EPSS
No
On KEV
Description
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Brave Brave brave-popup-builder allows Code Injection.This issue affects Brave: from n/a through 0.8.8.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BR
Brave · Brave
through 0.8.8 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-48202
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-48202
vdb-entry
https://patchstack.com/database/wordpress/plugin/brave-popup-builder/vulnerability/wordpress-brave-plugin-0-8-8-content-injection-vulnerability?_s_id=cve
More from Brave
7.5
CVE-2021-45884
In Brave Desktop 1.17 through 1.33 before 1.33.106, when CNAME-based adblocking and a proxying extension with a SOCKS fallback are enabled, additional DNS requests are issued…
6.5
CVE-2022-47934
Brave Browser before 1.43.88 allowed a remote attacker to cause a denial of service in private and guest windows via a crafted HTML file that mentions an ipfs:// or ipns:// URL
6.5
CVE-2022-47933
Brave Browser before 1.42.51 allowed a remote attacker to cause a denial of service via a crafted HTML file that references the IPFS scheme
6.5
CVE-2022-47932
Brave Browser before 1.43.34 allowed a remote attacker to cause a denial of service via a crafted HTML file that mentions an ipfs:// or ipns:// URL
6.5
CVE-2018-10799
A hang issue was discovered in Brave before 0.14.0 (on, for example, Linux)