Is CVE-2026-81571 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-81571?

CVE-2026-81571 has a CVSS v3 severity of MEDIUM (4.8).

Back

CVE-2026-81571

Description

The Brave WordPress plugin before 0.8.8 does not prevent a URL parameter used to pre-fill a form field from being passed to WordPress's shortcode engine, allowing unauthenticated attackers to have arbitrary shortcodes registered on the site executed server-side.