medium4.8
CVE-2026-81571
The Brave WordPress plugin before 0.8.8 does not prevent a URL parameter used to pre-fill a form field from being passed to WordPress's shortcode engine, allow…
Impact
The Brave WordPress plugin before 0.8.8 does not prevent a URL parameter used to pre-fill a form field from being passed to WordPress's shortcode engine, allowing unauthenticated attackers to have arbitrary shortcodes registered on the site executed server-side.
Affected products
| Product | Affected versions |
|---|---|
| Brave WordPress Plugin | before 0.8.8 |
Versions were read from the advisory text. No structured product data has been published for this record yet.