CVE-2026-15297 is a reflected cross-site scripting vulnerability in the Brevo WordPress plugin (formerly Sendinblue) affecting all versions up to and including 3.1.77. The vulnerability is due to improper neutralization of input during web page generation, specifically via the page parameter. An unauthenticated attacker can craft malicious links that inject arbitrary web scripts, which execute in the context of the victim's browser when the link is clicked. This can lead to partial confidentiality and integrity impacts as indicated by the CVSS vector (C:L/I:L/A:N). No official patch or remediation level has been confirmed as of the publication date.

Successful exploitation allows an unauthenticated attacker to perform reflected cross-site scripting attacks, potentially leading to the execution of arbitrary scripts in the context of the victim's browser. This can result in limited confidentiality and integrity impacts, such as theft of user session data or manipulation of displayed content. There is no indication of availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with links involving the page parameter in affected versions. Consider applying web application firewall (WAF) rules to detect and block suspicious input patterns related to this parameter. Monitor vendor channels for updates and apply patches promptly once released.