CVE-2026-81571: CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in Brave

CVE-2026-81571 describes a vulnerability in the Brave WordPress plugin prior to version 0.8.8. The flaw arises because a URL parameter intended to pre-fill a form field is not properly sanitized before being passed to WordPress's shortcode engine. This improper neutralization of special elements (CWE-74) enables unauthenticated attackers to register and execute arbitrary shortcodes on the server side, potentially impacting confidentiality and integrity. The CVSS 3.1 vector indicates the attack requires network access, has high complexity, no privileges or user interaction, and results in low confidentiality and integrity impact without availability impact.

An unauthenticated attacker can exploit this vulnerability to execute arbitrary WordPress shortcodes on the server. This could lead to unauthorized actions within the WordPress environment, potentially affecting data confidentiality and integrity. However, the attack complexity is high, and the overall impact is rated as medium severity with no direct availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 0.8.8, upgrading to version 0.8.8 or later (once available) is recommended when the vendor releases a fix. Until then, consider restricting access to affected functionality or disabling the plugin if feasible.