{"id":"CVE-2026-48202","kind":"vulnerability","aliases":["CVE-2026-48202"],"related":[],"title":"Brave popup builder: basic XSS lets injected script run in pages","description":"Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Brave Brave brave-popup-builder allows Code Injection.This issue affects Brave: from n/a through 0.8.8.","summary":"The Brave brave-popup-builder plugin does not neutralize script-related HTML tags in a web page, allowing code injection. An attacker who can supply input the plugin renders can run JavaScript in a visitor's browser.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["brave-popup-builder","package","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of brave-popup-builder in the WordPress plugin list or the plugin's main file header.\n- Look for `brave-popup-builder` in the site's plugin directory.","fix":"- brave-popup-builder: versions through `0.8.8` are affected; the sources do not name a fixed version.","status":"open","published_at":"2026-10-29T14:17:56+00:00","first_seen_at":"2026-10-29T14:25:23+00:00","triaged_at":"2026-10-29T14:26:05+00:00","updated_at":"2026-10-29T14:26:05+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-29T14:26:05Z","model":"claude-haiku-5-5","output":{"fix":"- brave-popup-builder: versions through `0.8.8` are affected; the sources do not name a fixed version.","reach":"internet","title":"Brave popup builder: basic XSS lets injected script run in pages","impact":"medium","summary":"The Brave brave-popup-builder plugin does not neutralize script-related HTML tags in a web page, allowing code injection. An attacker who can supply input the plugin renders can run JavaScript in a visitor's browser.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","brave-popup-builder"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs scripts in visitors' browsers on affected pages","analyst_note":"Confirm the fixed version and the vulnerable input path from the vendor advisory or the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-48202.","how_to_check":"- Check the installed version of brave-popup-builder in the WordPress plugin list or the plugin's main file header.\n- Look for `brave-popup-builder` in the site's plugin directory.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Brave popup builder plugin at version 0.8.8 or earlier are in scope, since the flaw is in how the plugin renders HTML. The sources do not say which input path is exploitable or whether admin access is needed, so treat any site with the plugin installed as potentially exposed. Sites that do not run this plugin can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000711,"input_tokens":4118,"output_tokens":598,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-48202':14A,17A '0.8.8':94C 'affect':89C 'allow':43B,85C 'attack':47B 'basic':4A,75C 'brave':1A,19B,25B,27B,79C,80C,82C,90C 'brave-popup-build':18B,26B,81C 'browser':62B 'builder':3A,21B,29B,84C 'code':44B,86C 'cve':12A,15A 'html':37B,69C 'improp':63C 'inject':7A,45B 'injection.this':87C 'input':51B 'issu':88C 'javascript':57B 'let':6A 'n/a':92C 'neutral':33B,64C 'packag':22B 'page':11A,42B,74C 'plugin':30B,53B 'popup':2A,20B,28B,83C 'relat':36B,68C 'render':54B 'run':9A,56B 'script':8A,35B,67C 'script-rel':34B,66C 'suppli':50B 'tag':38B,70C 'visitor':60B 'vulner':77C 'web':41B,73C 'wordpress':23B 'xss':5A,76C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Brave popup builder plugin at version 0.8.8 or earlier are in scope, since the flaw is in how the plugin renders HTML. The sources do not say which input path is exploitable or whether admin access is needed, so treat any site with the plugin installed as potentially exposed. Sites that do not run this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T14:17:56+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-48202","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48202","severity":null,"published_at":"2026-10-29T14:17:56+00:00","modified_at":"2026-10-29T14:17:56+00:00","first_seen_at":"2026-10-29T14:25:23+00:00","fetched_at":"2026-10-29T14:25:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}