Brave Popup Builder Vulnerabilities

[en] Missing Authorization vulnerability in Brave Brave brave-popup-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Brave: from n/a through <= 0.8.3.

Affected:

up to 0.8.3

Fix:

No patched version reported

Disclosed:

Dec 24, 2025

CVE-2025-68508 on NVD →

The Brave – Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 0.8.3. This makes it possible for unauthenticated attackers to perform an unaut...

CVSS:

5.3

Affected:

up to 0.8.3

Fixed in:

0.8.4

Disclosed:

Dec 23, 2025

CVE-2025-68508 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in Brave Brave Popup Builder.This issue affects Brave Popup Builder: from n/a through 0.7.0.

Affected:

up to 0.7.1

Fixed in:

0.7.1

Disclosed:

Aug 26, 2024

CVE-2024-43337 on NVD →

The Brave Popup Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.7.0. This is due to missing or incorrect nonce validation on the bravepop_ajax_zoho_init_token() function. This makes it possible for unauthenticated attackers to save an integration token via a...

CVSS:

4.3

Affected:

up to 0.7.0

Fixed in:

0.7.1

Disclosed:

Aug 16, 2024

CVE-2024-43337 on NVD →

[en] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Brave Brave Popup Builder allows Stored XSS.This issue affects Brave Popup Builder: from n/a through 0.6.9.

Affected:

up to 0.7.0

Fixed in:

0.7.0

Disclosed:

Jun 4, 2024

CVE-2024-35655 on NVD →

The Brave – Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 0.6.9 due to insufficient input sanitization and output escaping. This makes it possible for authent...

CVSS:

4.4

Affected:

up to 0.6.9

Fixed in:

0.7.0

Disclosed:

Jun 3, 2024

CVE-2024-35655 on NVD →

[en] Server-Side Request Forgery (SSRF) vulnerability in Brave Brave Popup Builder.This issue affects Brave Popup Builder: from n/a through 0.6.5.

Affected:

up to 0.6.6

Fixed in:

0.6.6

Disclosed:

Mar 29, 2024

CVE-2024-30453 on NVD →

The Brave – Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 0.6.5. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating fro...

CVSS:

7.2

Affected:

up to 0.6.5

Fixed in:

0.6.6

Disclosed:

Mar 28, 2024

CVE-2024-30453 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brave Brave – Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content allows Stored XSS.This issue affects Brave – Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Inte...

Affected:

up to 0.6.3

Fixed in:

0.6.3

Disclosed:

Feb 1, 2024

CVE-2023-51534 on NVD →

The Brave – Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 0.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authent...

CVSS:

4.4

Affected:

up to 0.6.2

Fixed in:

0.6.3

Disclosed:

Dec 27, 2023

CVE-2023-51534 on NVD →