Brands for WooCommerce

Brands for WooCommerce has 8 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2026; all 8 are fixed as of October 2026. Their average CVSS score is 5.5, and the most serious one scores 6.5 out of 10. 2026 was the busiest year with 3 disclosures.

The most common weakness is Cross-Site Scripting, behind 4 of the records (50%). Other recurring categories include Cross-Site Request Forgery (CSRF), Missing Authorization.

Every one of the 8 issues recorded for Brands for WooCommerce has a vendor fix available, so running the current release closes all known holes.

4 independent researchers contributed these findings, most of them (3) reported by Wordfence PRISM.

Strategic Overview

Avg CVSSMedium

5.5/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Brands for WooCommerce vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.5CVE-2025-68519

Brands for WooCommerce <= 3.8.6.3 - Authenticated (Contributor+) SQL Injection

Read the full analysis

Vulnerability Records

8 records


2026-07-23 18:26	Brands for WooCommerce <= 3.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' Shortcode Attribute Brands for WooCommerce <= 3.8.8	`CVE-2026-15648`	6.4 Medium	Wordfence PRISM	Yes
2026-07-22 20:21	Brands for WooCommerce <= 3.8.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'br_brand_tooltip' Term Meta Field Brands for WooCommerce <= 3.8.8	`CVE-2026-15647`	4.4 Medium	Wordfence PRISM	Yes
2026-07-22 20:20	Brands for WooCommerce <= 3.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute Brands for WooCommerce <= 3.8.8	`CVE-2026-15646`	6.4 Medium	Wordfence PRISM	Yes
2025-12-26 00:00	Brands for WooCommerce <= 3.8.6.3 - Authenticated (Contributor+) SQL Injection Brands for WooCommerce <= 3.8.6.3	`CVE-2025-68519`	6.5 Medium	0xd4rk5id3	Yes
2023-09-22 00:00	Brands for WooCommerce <= 3.8.2.2 - Cross-Site Request Forgery Brands for WooCommerce < 3.8.2.3	`N/A`	4.3 Medium	Anonymous	Yes
2023-09-22 00:00	Brands for WooCommerce <= 3.8.2.2 - Missing Authorization to Unauthenticated Order Manipulation and Information Retrieval Brands for WooCommerce < 3.8.2.3	`CVE-2023-44149`	4.3 Medium	thiennv	Yes
2023-05-10 00:00	Brands for WooCommerce <= 3.7.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Brands for WooCommerce <= 3.7.0.6	`CVE-2023-23667`	6.4 Medium	István Márton	Yes
2022-12-13 00:00	BeRocket Plugins <= (Various Versions) - Missing Authorization Brands for WooCommerce <= 3.7.0.5	`CVE-2022-45813`	5.4 Medium	István Márton	Yes

Showing 1–8 of 8 reports