CVE-2024-5191 is a stored Cross-Site Scripting (XSS) vulnerability identified in the Branda – White Label WordPress, Custom Login Page Customizer plugin, a popular WordPress plugin used to customize login pages and white-label branding. The vulnerability exists due to improper neutralization of input during web page generation, specifically through the 'mime_types' parameter. This parameter is insufficiently sanitized and escaped, allowing authenticated users with Author-level privileges or higher to inject arbitrary JavaScript code into pages generated by the plugin. Because the injected scripts are stored persistently, they execute whenever any user visits the affected page, potentially compromising user sessions, stealing cookies, or performing unauthorized actions under the victim's context. The vulnerability does not require user interaction but does require the attacker to have authenticated access with at least Author-level permissions, which is a moderately high privilege level in WordPress. The CVSS 3.1 base score is 6.4, reflecting a medium severity with network attack vector, low attack complexity, and no user interaction needed. The scope is changed (S:C), indicating that the vulnerability can affect resources beyond the initially vulnerable component. No public exploits have been reported yet, but the vulnerability is publicly disclosed and should be addressed promptly. The plugin affects all versions up to and including 3.4.17. No official patch links are provided in the source data, so users should monitor vendor updates or apply manual mitigations.

This vulnerability can lead to significant security risks for organizations running WordPress sites with the affected plugin. An attacker with Author-level access can inject malicious scripts that execute in the context of other users, including administrators, potentially leading to session hijacking, credential theft, unauthorized actions, or defacement. This undermines the confidentiality and integrity of the website and its users. Although availability impact is low, the compromise of administrative accounts or user data can have severe operational and reputational consequences. Organizations with multi-user WordPress environments are particularly at risk, especially those allowing Author-level permissions to external contributors or less trusted users. The vulnerability can facilitate lateral movement within the site and may serve as a foothold for further attacks. Given the widespread use of WordPress globally, the potential attack surface is large, and exploitation could affect a broad range of industries including e-commerce, media, education, and government websites.

1. Immediately update the Branda plugin to a patched version once released by the vendor. Monitor official wpmudev channels for updates. 2. In the absence of an official patch, restrict Author-level and higher privileges to trusted users only, minimizing the risk of malicious script injection. 3. Implement Web Application Firewall (WAF) rules to detect and block suspicious payloads targeting the 'mime_types' parameter. 4. Employ Content Security Policy (CSP) headers to limit the execution of unauthorized scripts on affected pages. 5. Conduct regular security audits and code reviews of customizations involving the plugin to identify unsafe input handling. 6. Educate site administrators about the risks of granting elevated privileges and enforce the principle of least privilege. 7. Monitor logs and user activity for unusual behavior indicative of exploitation attempts. 8. Consider temporarily disabling the plugin if immediate patching is not feasible and the risk is high. 9. Use security plugins that can detect and remediate stored XSS payloads in the WordPress database.