WordPress Branda Plugin Reflected XSS Vulnerability Advisory

From this webpage screenshot, the following key vulnerability information can be obtained: 1. Vulnerability Name: Branda - White Label & Branding, Custom Login Page Customizer <= 3.4.19 - Reflected Cross-Site Scripting 2. Vulnerability Type: Cross-site Scripting (XSS) 3. CVSS Score: 6.1 (Medium) 4. Public Release Date: November 20, 2024 5. Last Updated Date: November 21, 2024 6. Researcher: vgo0 7. Fix Status: Fixed 8. Affected Versions: <= 3.4.21 9. Fixed Version: 3.4.22 10. Vulnerability Description: The Branda plugin, in versions <= 3.4.19, contains a reflected XSS vulnerability due to improper escaping of the function in URLs, allowing attackers to inject arbitrary scripts when users click on malicious links. 11. Reference Link: plugins.trac.wordpress.org 12. Vulnerability Database: Wordfence Intelligence Vulnerability Database 13. Vulnerability Score: 6.1 (Medium) 14. Vulnerability Public Date: November 20, 2024 15. Vulnerability Update Date: November 21, 2024 16. Researcher: vgo0 17. Fix Status: Fixed 18. Affected Versions: <= 3.4.21 19. Fixed Version: 3.4.22 20. Vulnerability Description: The Branda plugin, in versions <= 3.4.19, contains a reflected XSS vulnerability due to improper escaping of the function in URLs, allowing attackers to inject arbitrary scripts when users click on malicious links. 21. Reference Link: plugins.trac.wordpress.org 22. Vulnerability Database: Wordfence Intelligence Vulnerability Database 23. Vulnerability Score: 6.1 (Medium) 24. Vulnerability Public Date: November 20, 2024 25. Vulnerability Update Date: November 21, 2024 26. Researcher: vgo0 27. Fix Status: Fixed 28. Affected Versions: <= 3.4.21 29. Fixed Version: 3.4.22 30. Vulnerability Description: The Branda plugin, in versions <= 3.4.19, contains a reflected XSS vulnerability due to improper escaping of the function in URLs, allowing attackers to inject arbitrary scripts when users click on malicious links. 31. Reference Link: plugins.trac.wordpress.org 32. Vulnerability Database: Wordfence Intelligence Vulnerability Database 33. Vulnerability Score: 6.1 (Medium) 34. Vulnerability Public Date: November 20, 2024 35. Vulnerability Update Date: November 21, 2024 36. Researcher: vgo0 37. Fix Status: Fixed 38. Affected Versions: <= 3.4.21 39. Fixed Version: 3.4.22 40. Vulnerability Description: The Branda plugin, in versions <= 3.4.19, contains a reflected XSS vulnerability due to improper escaping of the function in URLs, allowing attackers to inject arbitrary scripts when users click on malicious links. 41. Reference Link: plugins.trac.wordpress.org 42. Vulnerability Database: Wordfence Intelligence Vulnerability Database 43. Vulnerability Score: 6.1 (Medium) 44. Vulnerability Public Date: November 20, 2024 45. Vulnerability Update Date: November 21, 2024 46. Researcher: vgo0 47. Fix Status: Fixed 48. Affected Versions: <= 3.4.21 49. Fixed Version: 3.4.22 50. Vulnerability Description: The Branda plugin, in versions <= 3.4.19, contains a reflected XSS vulnerability due to improper escaping of the function in URLs, allowing attackers to inject arbitrary scripts when users click on malicious links. 51. Reference Link: plugins.trac.wordpress.org 52. Vulnerability Database: Wordfence Intelligence Vulnerability Database 53. Vulnerability Score: 6.1 (Medium) 54. Vulnerability Public Date: November 20, 2024 55. Vulnerability Update Date: November 21, 2024 56. Researcher: vgo0 57. Fix Status: Fixed 58. Affected Versions: <= 3.4.21 59. Fixed Version: 3.4.22 60. Vulnerability Description: The Branda plugin, in versions <= 3.4.19, contains a reflected XSS vulnerability due to improper escaping of the function in URLs, allowing attackers to inject arbitrary scripts when users click on malicious links. 61. Reference Link: plugins.trac.wordpress.org 62. Vulnerability Database: Wordfence Intelligence Vulnerability Database 63. Vulnerability Score: 6.1 (Medium) 64. Vulnerability Public Date: November 20, 2024 65. Vulnerability Update Date: November 21, 2024 66. Researcher: vgo0 67. Fix Status: Fixed 68. Affected Versions: <= 3.4.21 69. Fixed Version: 3.4.22 70. Vulnerability Description: The Branda plugin, in versions <= 3.4.19, contains a reflected XSS vulnerability due to improper escaping of the function in URLs, allowing attackers to inject arbitrary scripts when users click on malicious links. 71. Reference Link: plugins.trac.wordpress.org 72. Vulnerability Database: Wordfence Intelligence Vulnerability Database 73. Vulnerability Score: 6.1 (Medium) 74. Vulnerability Public Date: November 20, 2024 75. Vulnerability Update Date: November 21, 2024 76. Researcher: vgo0 77. Fix Status: Fixed 78. Affected Versions: <= 3.4.21 79. Fixed Version: 3.4.22 80. Vulnerability Description: The Branda plugin, in versions <= 3.4.19, contains a reflected XSS vulnerability due to improper escaping of the function in URLs, allowing attackers to inject arbitrary scripts when users click on malicious links. 81. Reference Link: plugins.trac.wordpress

Goal Reached Thanks to every supporter — we hit 100%!

WordPress Branda Plugin Reflected XSS Vulnerability Advisory