CVE-2024-6625

The WP Total Branding – Complete branding solution for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

• CWE-79

• https://plugins.trac.wordpress.org/browser/wp-total-branding/trunk/includes/modules/login.php#L87
• https://plugins.trac.wordpress.org/changeset/3115880/wp-total-branding/trunk/includes/modules/login.php
• https://plugins.trac.wordpress.org/changeset/3115880/wp-total-branding/trunk/includes/options/login.php
• https://wordpress.org/plugins/wp-total-branding/#developers
• https://www.wordfence.com/threat-intel/vulnerabilities/id/3b6ac92f-2ad1-4528-b157-5e49d6f224a5?source=cve
• https://plugins.trac.wordpress.org/browser/wp-total-branding/trunk/includes/modules/login.php#L87
• https://plugins.trac.wordpress.org/changeset/3115880/wp-total-branding/trunk/includes/modules/login.php
• https://plugins.trac.wordpress.org/changeset/3115880/wp-total-branding/trunk/includes/options/login.php
• https://wordpress.org/plugins/wp-total-branding/#developers
• https://www.wordfence.com/threat-intel/vulnerabilities/id/3b6ac92f-2ad1-4528-b157-5e49d6f224a5?source=cve

Published

Jul 12, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-6617The NinjaTeam Header Footer Custom Code WordPress plugin bef…4.8
• CVE-2024-6618In Ocean Data Systems Dream Report, a path traversal vulnera…8.5
• CVE-2024-6619In Ocean Data Systems Dream Report, an incorrect permission …8.5
• CVE-2024-6620Honeywell PC42t, PC42tp, and PC42d Printers, T10.19.020016 t…3.5
• CVE-2024-6621The RSS Aggregator – RSS Import, News Feeds, Feed to Post, a…4.3
• CVE-2024-6624The JSON API User plugin for WordPress is vulnerable to priv…9.8
• CVE-2024-6626The EleForms – All In One Form Integration including DB for …5.3
• CVE-2024-6627The Happy Addons for Elementor plugin for WordPress is vulne…5.4
• CVE-2024-6628The EleForms – All In One Form Integration including DB for …4.3
• CVE-2024-6629The All-in-One Video Gallery plugin for WordPress is vulnera…5.4
• CVE-2024-6630Rejected reason: **REJECT** This CVE ID was issued in error …
• CVE-2024-6631The ImageRecycle pdf & image compression plugin for WordPres…4.3