CVE-2026-15297: Brevo WordPress Plugin Reflected XSS Vulnerability

Technical summary

CVE-2026-15297 is a reflected XSS vulnerability (CWE-79) in the Brevo plugin for WordPress affecting all versions through 3.1.77. The 'page' parameter is passed to the output without sufficient input sanitization or output escaping. Because the payload is reflected in the HTTP response rather than stored, the attacker must deliver the malicious URL to the target. The vulnerability has a CVSS 3.1 score of 6.1 (Medium), with a network-based attack vector, low complexity, no privilege requirements, but user interaction is required. The impact includes confidentiality and integrity compromise within the scope of the user's browser context.

Business impact

Organizations using the Brevo plugin to manage email campaigns or newsletter subscriptions face a risk of account compromise and data theft. An attacker exploiting this vulnerability could harvest session tokens, capture sensitive information displayed on the WordPress dashboard, or perform unauthorized actions on behalf of the victim. If an admin is tricked into clicking a malicious link, the attacker gains the ability to execute actions with administrative privileges. For businesses managing customer data through this plugin, the reputational and regulatory (GDPR, CCPA) implications of a data breach are significant.

Affected systems

All installations of the Brevo (formerly Sendinblue) Newsletter, SMTP, Email marketing and Subscribe forms plugin for WordPress running version 3.1.77 or earlier are affected. The vulnerability does not require specific server configurations or uncommon plugin settings to be exploitable—it affects the plugin in its default state. The attack surface includes any user with access to WordPress, from subscribers to administrators, though administrative targets yield higher-value compromises.

Exploitability

This vulnerability requires user interaction and relies on social engineering. An attacker must craft a URL containing the XSS payload in the 'page' parameter and convince a WordPress user to click it. The barrier to exploitation is low from a technical standpoint—no advanced tools or specialized knowledge is needed—but the success rate depends on the attacker's ability to make the link credible. Emails impersonating legitimate sources, forum posts, or comments linking to the malicious URL are common delivery vectors. The vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, suggesting active exploitation in the wild has not been widely reported, though this does not eliminate the risk.

Remediation

Update the Brevo plugin to a version released after July 10, 2026 that addresses this vulnerability. Check the plugin's official repository and release notes for patch availability. Until an update is released, disable the plugin if it is not critical to operations, or restrict access to the WordPress admin panel to a trusted IP whitelist. Additionally, implement web application firewalls (WAF) rules to detect and block requests containing common XSS payloads in the 'page' parameter.

Patch guidance

Verify the latest available version of the Brevo plugin against the official WordPress plugin repository. The vulnerability affects versions up to 3.1.77; any version published after the July 10, 2026 publication date should be tested and evaluated for compatibility. Review the vendor advisory and release notes to confirm the specific version that resolves CWE-79. Apply the patch in a non-production environment first to validate functionality, particularly email delivery workflows and form submissions, before deploying to production.

Detection guidance

Monitor HTTP request logs for suspicious activity targeting WordPress admin pages, particularly requests containing encoded XSS payloads (such as script tags, event handlers, or JavaScript protocol schemes) in the 'page' parameter. Indicators include requests with characters like '<', '>', '%3C', '%3E', 'onerror=', 'onclick=', or 'javascript:'. Implement security headers such as Content-Security-Policy (CSP) to restrict script execution and mitigate the impact of reflected XSS. WordPress security plugins (Wordfence, Sucuri) can log and alert on XSS attempts. Review server and WordPress access logs for patterns of unusual link sharing or user reports of unexpected redirects.

Why prioritize this

Despite a Medium CVSS score, this vulnerability warrants prompt attention because it affects a widely deployed email marketing plugin, requires no authentication, and can lead to session hijacking or administrative account compromise. The attack surface is broad—any WordPress site running Brevo is at risk—and the social engineering vector, while not trivial, is well-established. Phishing campaigns and watering-hole attacks frequently exploit reflected XSS to steal credentials from high-value targets like administrators and content editors. Prioritize patching sites where the plugin is actively used for critical business email functions.

Risk score, explained

The CVSS 3.1 score of 6.1 reflects a Medium severity assessment: the attack requires user interaction and a successful social engineering attempt, which limits the likelihood of exploitation at scale. However, the network-based vector (no local access required), low complexity of the attack, and the absence of privilege requirements elevate the concern. The scope is marked as 'Changed,' indicating the vulnerability can affect resources beyond the vulnerable component (e.g., other users' sessions). The limited impact to confidentiality and integrity (rather than availability) and the reliance on user interaction prevent a higher score. Organizations should not underestimate Medium severity vulnerabilities in widely used plugins, as targeted campaigns can successfully exploit them.

Frequently asked questions