Unknown Brave vulnerabilities

3 CVEs affecting Unknown Brave, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-81571, published 2026-09-02.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-77116, published 2026-08-23. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. Brave Popup Builder (slug: brave-popup-builder) has a broken access control issue in versions through 0.8.5. Any logged-in user - Subscriber or WooCommerce Customer is enough — can read popup content…
CVE-2026-77115, published 2026-08-23. High severity, CVSS 7.1. EPSS: 0.3% chance of exploitation in the next 30 days. Brave Popup Builder (brave-popup-builder) up to version 0.8.5 reflects UTM query parameters into popup form HTML without escaping them.
CVE-2026-81571, published 2026-09-02. Medium severity, CVSS 4.8. EPSS: 0.2% chance of exploitation in the next 30 days. The Brave WordPress plugin before 0.8.8 does not prevent a URL parameter used to pre-fill a form field from being passed to WordPress's shortcode engine, allowing unauthenticated attackers to have…