The Branda – White Label & Branding, Free Login Page Customizer WordPress plugin suffers from a stored cross-site scripting vulnerability (CWE-79) via the 'mime_types' parameter. Authenticated users with Author-level privileges or above can inject arbitrary web scripts due to insufficient input sanitization and output escaping. This vulnerability affects all versions up to 3.4.17. The CVSS 3.1 base score is 6.4 (medium severity), with network attack vector, low attack complexity, privileges required at the level of an authenticated author, no user interaction needed, and impacts confidentiality and integrity with no impact on availability. No patch or official fix is currently documented.

An authenticated attacker with Author-level access or higher can inject persistent malicious scripts into pages via the vulnerable 'mime_types' parameter. These scripts execute in the context of users visiting the injected pages, potentially leading to unauthorized actions or data disclosure limited to the confidentiality and integrity impacts described. There is no known exploitation in the wild. The vulnerability does not affect availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Author-level access to trusted users only and monitor for suspicious activity related to the plugin. Avoid using the vulnerable parameter if possible. No official patch or workaround has been provided at this time.