CVE-2026-15647

Name of the Vulnerable Software and Affected Versions Brands for WooCommerce versions prior to 3.8.9

Description Insufficient input sanitization and output escaping in the br brand tooltip Term Meta Field allow authenticated attackers with custom-level access and above to perform Stored Cross-Site Scripting (XSS). This occurs when arbitrary web scripts are injected into pages and executed upon user access. Since the payload is stored in term meta, the WordPress unfiltered html capability exception is bypassed, enabling users with Shop Manager-level permissions to exploit the issue.

Recommendations Update Brands for WooCommerce to version 3.8.9 or later.