CVE-2024-9371: Improper Neutralization of Input During Web Page Generation

The Branda – White Label & Branding, Custom Login Page Customizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of removequeryarg without appropriate escaping on the URL in all versions up to, and including, 3.4.19. This makes it possible for unauthenticated...

CVE-2024-6554

The Branda – White Label WordPress, Custom Login Page Customizer plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.4.18. This is due the plugin utilizing composer without preventing direct access to the files. This makes it possible for...

CVE-2024-6554 Branda – White Label WordPress, Custom Login Page Customizer <= 3.4.18 - Unauthenticated Full Path Disclosure

The Branda – White Label WordPress, Custom Login Page Customizer plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.4.18. This is due the plugin utilizing composer without preventing direct access to the files. This makes it possible for...

CVE-2024-6554: Exposure of Sensitive Information to an Unauthorized Actor

The Branda – White Label WordPress, Custom Login Page Customizer plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.4.18. This is due the plugin utilizing composer without preventing direct access to the files. This makes it possible for...

PT-2024-37711 · WordPress · Branda – White Label Wordpress

Name of the Vulnerable Software and Affected Versions: The Branda – White Label WordPress, Custom Login Page Customizer plugin for WordPress versions up to, and including, 3.4.18 Description: The plugin is vulnerable to Full Path Disclosure due to utilizing composer without preventing direct acce...

PT-2024-35042

Name of the Vulnerable Software and Affected Versions The Branda – White Label WordPress, Custom Login Page Customizer plugin for WordPress versions up to, and including, 3.4.17 Description The issue is related to Stored Cross-Site Scripting via the mime types parameter due to insufficient input...

CVE-2024-5191: Improper Neutralization of Input During Web Page Generation

The Branda – White Label WordPress, Custom Login Page Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘mimetypes’ parameter in all versions up to, and including, 3.4.17 due to insufficient input sanitization and output escaping. This makes it possible for...