# CVE-2026-77115: Brave Popup Builder reflected XSS via UTM parameters

Source: https://junglewise.ai/threats/cve-2026-77115-brave-popup-builder-reflected-xss-via-utm-parameters  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-23. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-77115 · Severity: high · CVSS 7.1 · Published 2026-08-23

Brave Popup Builder is a WordPress plugin used to create and display popup campaigns on websites. The plugin fails to properly escape user-supplied UTM tracking parameters before displaying them in popup form fields, allowing attackers to inject malicious code that executes in visitors' browsers without requiring any authentication or action beyond opening a crafted link. This could lead to session hijacking, credential theft, or malware distribution.

## Quick answers

**Is CVE-2026-77115 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77115 being exploited in the wild.

**How severe is CVE-2026-77115?** High severity, with a CVSS score of 7.1, published 23 August 2026.

**Which products and versions are affected?** Brave Popup Builder up to 0.8.5.

**Is there a fix for CVE-2026-77115?** A patch was published on 2026-08-23: Fixed in version 0.8.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-77115 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-77115?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a reflected cross-site scripting (XSS) flaw (CWE-79) affecting Brave Popup Builder versions up to 0.8.5. When a popup form is configured with fields that use "UTM Parameter" as the default value source, the plugin directly reflects the corresponding $_GET parameter into the HTML output without applying any escaping functions (esc_attr, esc_html, esc_textarea). The vulnerable code is located in lib/frontend/Form.php in the renderInput() (line 408), renderHidden() (lines 442-456), and renderTextarea() (lines 475-484) functions. An unauthenticated attacker can craft a malicious URL with injected HTML/JavaScript in UTM parameters (e.g., utm_source, utm_medium, utm_campaign) and send it to victims; when the page containing the popup loads, the payload executes in the victim's browser context regardless of session state. The vulnerability was fixed in version 0.8.6 by properly entity-encoding reflected values.

## Affected products

- Brave Popup Builder up to 0.8.5

## Timeline

- 2026-08-21: disclosed
- 2026-08-23: patched: Fixed in version 0.8.6

## References

- [https://wpscan.com/vulnerability/d4a760c0-8e71-4261-a08b-9b6a296c631a/](https://wpscan.com/vulnerability/d4a760c0-8e71-4261-a08b-9b6a296c631a/)