Brands for WooCommerce

Information

Software Type	Plugin
Software Slug	brands-for-woocommerce (view on wordpress.org)
Software Status	Active
Software Author	berocket
Software Website	wordpress.org
Software Downloads	181,696
Software Active Installs	5,000
Software Record Last Updated	October 14, 2026

8 Vulnerabilities

Submit a Vulnerability

Brands for WooCommerce <= 3.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' Shortcode Attribute

6.4

CVE-2026-15648

Jul 23, 2026

Researcher: Wordfence PRISM

Brands for WooCommerce <= 3.8.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'br_brand_tooltip' Term Meta Field

4.4

CVE-2026-15647

Jul 22, 2026

Researcher: Wordfence PRISM

Brands for WooCommerce <= 3.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute

6.4

CVE-2026-15646

Jul 22, 2026

Researcher: Wordfence PRISM

Brands for WooCommerce <= 3.8.6.3 - Authenticated (Contributor+) SQL Injection

6.5

CVE-2025-68519

Dec 26, 2025

Researcher: 0xd4rk5id3

Brands for WooCommerce <= 3.8.2.2 - Cross-Site Request Forgery

4.3

CVE ID Unknown

Sep 22, 2023

Researchers:

Brands for WooCommerce <= 3.8.2.2 - Missing Authorization to Unauthenticated Order Manipulation and Information Retrieval

4.3

CVE-2023-44149

Sep 22, 2023

Researcher: thiennv

Brands for WooCommerce <= 3.7.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4

CVE-2023-23667

May 10, 2023

Researcher: István Márton

BeRocket Plugins <= (Various Versions) - Missing Authorization

5.4

CVE-2022-45813

Dec 13, 2022

Researcher: István Márton

Title	Status	CVE ID	CVSS	Researchers	Date
Brands for WooCommerce <= 3.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' Shortcode Attribute	Patched	CVE-2026-15648	6.4	Wordfence PRISM	July 23, 2026
Brands for WooCommerce <= 3.8.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'br_brand_tooltip' Term Meta Field	Patched	CVE-2026-15647	4.4	Wordfence PRISM	July 22, 2026
Brands for WooCommerce <= 3.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute	Patched	CVE-2026-15646	6.4	Wordfence PRISM	July 22, 2026
Brands for WooCommerce <= 3.8.6.3 - Authenticated (Contributor+) SQL Injection	Patched	CVE-2025-68519	6.5	0xd4rk5id3	December 26, 2025
Brands for WooCommerce <= 3.8.2.2 - Cross-Site Request Forgery	Patched		4.3		September 22, 2023
Brands for WooCommerce <= 3.8.2.2 - Missing Authorization to Unauthenticated Order Manipulation and Information Retrieval	Patched	CVE-2023-44149	4.3	thiennv	September 22, 2023
Brands for WooCommerce <= 3.7.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	Patched	CVE-2023-23667	6.4	István Márton	May 10, 2023
BeRocket Plugins <= (Various Versions) - Missing Authorization	Patched	CVE-2022-45813	5.4	István Márton	December 13, 2022

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation