Executive brief
The Brave Popup Builder WordPress plugin is used to create popup campaigns on websites. Versions before 0.8.8 allow unauthenticated attackers to execute arbitrary shortcodes by injecting them into URL parameters that are passed to form fields. An attacker can exploit this to run malicious code on the server if a site has a popup with a URL parameter-based form field published.
Technical details
The plugin fails to sanitize URL parameters that are configured to pre-fill form fields before passing them to WordPress's shortcode engine. Specifically, when a hidden form field is set to use a UTM parameter as its default value, the plugin passes the URL parameter directly to do_shortcode() without escaping. An unauthenticated attacker can craft a request containing a shortcode (e.g., utm_medium=[audio src="..."] or [caption]...[/caption]) to have any registered shortcode on the site executed server-side. Exploitation requires that the targeted site have at least one popup campaign with a form containing a hidden field configured to accept URL parameter values, but no authentication is required. The vulnerability was fixed in version 0.8.8.
Affected products
- Brave Popup Builder < 0.8.8
Timeline
- 2026-08-31: disclosed
- 2026-08-31: patched: Fixed in version 0.8.8