CVE Database /
CVE-2026-15297
CVE · Medium
CVE-2026-15297 — Brevo – Email, SMS, Web Push, Chat, and more. [mailin] < 3.1.78
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2026-15297
|
Brevo – Email, SMS, Web Push, Chat, and more. [mailin] < 3.1.78 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium
6.1
|
< 3.1.78
|
3.1.78 |
2024-03-22 |
—
|
CVE-2026-15297
The Brevo plugin for WordPress contains a security flaw affecting all versions up to 3.1.77, allowing malicious actors to embed unauthorized code into pages by exploiting the page parameter without requiring authentication. This vulnerability arises from inadequate filtering of input data and insufficient protection against potentially hazardous scripts being executed on affected pages.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings