The Branda – White Label & Branding, Free Login Page Customizer plugin for WordPress suffers from a reflected cross-site scripting vulnerability due to improper neutralization of input during web page generation. Specifically, the plugin uses the remove_query_arg function without appropriate escaping of URL parameters, enabling attackers to inject malicious scripts. This vulnerability affects all versions up to and including 3.4.19 and can be exploited by unauthenticated attackers who trick users into clicking malicious links, leading to script execution in the context of the affected site.

Successful exploitation can lead to the execution of arbitrary scripts in the context of the affected website, potentially allowing attackers to steal user session data, perform actions on behalf of the user, or conduct phishing attacks. The vulnerability requires user interaction (clicking a crafted link) and does not grant direct system access or denial of service. The CVSS score of 6.1 reflects a medium impact on confidentiality and integrity with no impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with links related to the affected plugin and consider disabling or removing the plugin if possible. Monitor the vendor's communications for updates on patches or official mitigations.