The Brave Popup Builder WordPress plugin, before version 0.8.8, accepts a URL parameter that can pre‑fill form fields. The supplied data is passed to WordPress’s shortcode engine, allowing an unauthenticated attacker to register and execute arbitrary shortcodes on the site. The flaw can lead to server‑side code execution or other actions defined by the malicious shortcodes, compromising site integrity and confidentiality.

Sites that use the Brave Popup Builder plugin v0.8.7 or earlier are vulnerable. The plugin, distributed by Brave and hosted on the WordPress Plugin Directory, permits UTM or other query parameters to pre‑fill form fields, which are not sanitized before reaching the shortcode processor.

The CVSS score of 4.8 categorizes the vulnerability as medium severity. EPSS data is unavailable and the flaw is not listed in the CISA KEV catalog, indicating no widespread documented exploitation. Nonetheless, the attack does not require authentication and can be triggered via a crafted URL containing malicious UTM parameters; once the payload reaches WordPress, the shortcode engine executes it, potentially enabling code execution or content tampering.