Medium severity · published Nov 21, 2024
CVE-2024-9371
Branda – White Label & Branding, Custom Login Page Customizer <= 3.4.19 - Reflected Cross-Site Scripting
6.1
CVSS
0.6%
EPSS
No
On KEV
Description
The Branda – White Label & Branding, Custom Login Page Customizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.4.19. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BW
Branda – White Label & Branding, Free Login Page Customizer · wpmudev
through 3.4.21 · source: vendor
Affected product
BW
Branda – White Label & Branding, Free Login Page Customizer
wpmudev
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-9371
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-9371
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/branda-white-labeling/tags/3.4.19/inc/class-branda-admin.php#L1871
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3191895%40branda-white-labeling&new=3191895%40branda-white-labeling&sfp_email=&sfph_mail=
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/eb60e5c8-cbda-4488-816c-a7fdf2b39fd6?source=cve
More from Branda – White Label & Branding, Free Login Page Customizer
9.8
CVE-2026-11551
Branda – White Label & Branding, Free Login Page Customizer <= 3.4.29 - Unauthenticated Privilege Escalation via Account Takeover
9.8
CVE-2025-14998
Branda – White Label & Branding, Free Login Page Customizer <= 3.4.24 - Unauthenticated Privilege Escalation via Account Takeover
5.4
CVE-2024-5191
Branda – White Label WordPress, Custom Login Page Customizer <= 3.4.17 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload
5.3
CVE-2024-6554
Branda – White Label WordPress, Custom Login Page Customizer <= 3.4.18 - Unauthenticated Full Path Disclosure