# CVE-2026-15647: BeRocket Brands for WooCommerce Stored XSS in br_brand_tooltip

Source: https://junglewise.ai/threats/cve-2026-15647-berocket-brands-for-woocommerce-stored-xss-in-br-brand-tooltip  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-23. Updated: 2026-07-23  
License: CC BY 4.0 with a link back

CVE-2026-15647 · Severity: medium · CVSS 4.4 · Published 2026-07-23

The Brands for WooCommerce plugin for WordPress, which allows store owners to organize products by brand, contains a security flaw that allows certain authorized users to inject malicious scripts into the website. An attacker with Shop Manager or similar permissions could use this to run unauthorized code in the browsers of other site visitors or administrators. This could lead to unauthorized actions being performed on the site or the theft of sensitive session information.

Technologies: [BeRocket Brands for WooCommerce](https://junglewise.ai/threats/technologies/brands-for-woocommerce). Vendors: [BeRocket](https://junglewise.ai/threats/vendors/berocket).

## Quick answers

**Is CVE-2026-15647 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-15647 being exploited in the wild.

**How severe is CVE-2026-15647?** Medium severity, with a CVSS score of 4.4, published 23 July 2026.

**Which products and versions are affected?** BeRocket Brands for WooCommerce up to, and including, 3.8.8.

**Is there a fix for CVE-2026-15647?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-15647 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-15647?** Check whether you run BeRocket Brands for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Brands for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on the 'br_brand_tooltip' term meta field. This vulnerability allows authenticated attackers with high-level permissions (such as Shop Managers) to inject arbitrary web scripts. Because the payload is stored in term meta rather than standard post content, it bypasses the 'unfiltered_html' capability restrictions typically applied to these user roles. The scripts execute whenever a user accesses a page where the affected brand tooltip is displayed. The issue is present in all versions up to and including 3.8.8.

## Affected products

- BeRocket Brands for WooCommerce up to, and including, 3.8.8

## Timeline

- 2026-07-23: disclosed
- 2026-07-23: advisory

## References

- [https://plugins.trac.wordpress.org/browser/brands-for-woocommerce/tags/3.8.8/main.php](https://plugins.trac.wordpress.org/browser/brands-for-woocommerce/tags/3.8.8/main.php)
- [https://plugins.trac.wordpress.org/browser/brands-for-woocommerce/tags/3.8.8/main.php](https://plugins.trac.wordpress.org/browser/brands-for-woocommerce/tags/3.8.8/main.php)
- [https://plugins.trac.wordpress.org/changeset?reponame=&old=3608899%40brands-for-woocommerce&new=3608899%40brands-for-woocommerce](https://plugins.trac.wordpress.org/changeset?reponame=&old=3608899%40brands-for-woocommerce&new=3608899%40brands-for-woocommerce)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/89f6fa65-ef71-491e-8959-591b58d1444c?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/89f6fa65-ef71-491e-8959-591b58d1444c?source=cve)

## Related threats

- [BeRocket Brands for WooCommerce Stored XSS in width shortcode attribute](https://junglewise.ai/threats/cve-2026-15648-berocket-brands-for-woocommerce-stored-xss-in-width-shortcode)
- [BeRocket Brands for WooCommerce Stored XSS in style shortcode attribute](https://junglewise.ai/threats/cve-2026-15646-berocket-brands-for-woocommerce-stored-xss-in-style-shortcode)