Brave Popup Builder – Unauthenticated Reflected Cross-Site Scripting (XSS)

I identified an unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability in the Brave Popup Builder (Brave Conversion Engine) WordPress plugin. When a published popup contains a form field configured to pre-fill its value from a UTM query parameter, user-controlled input is reflected into the page without proper output encoding. This allows arbitrary JavaScript execution through a crafted URL.

The issue has been responsibly disclosed to the vendor and submitted to the WPScan vulnerability database.