Branda EUVD-2026-90222

Requires WordPress running the Branda (white-labeling) plugin at version 3.4.32 or earlier. Per the vulnerability title ('Subscriber' XSS), an attacker needs at least a low-privileged authenticated Subscriber account to inject the payload, and exploitation further depends on a victim (typically a higher-privileged user/administrator) viewing the malicious content - the UI:R requirement. Limiting factors: authenticated access is needed (contradicting the vector's PR:N), the impact is confined to the browser JavaScript context (low CIA), and sites that disable open user registration substantially raise the bar to obtaining the required Subscriber account.

This is a stored/reflected Cross-Site Scripting flaw (CWE-79) in the Branda WordPress plugin, reported by Patchstack with a CVSS 3.1 score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). The network vector, low complexity and scope change (S:C) drive the score, but the impacts are all Low (C:L/I:L/A:L), which is typical of browser-context XSS rather than server compromise. There is a notable internal conflict: the vulnerability title explicitly says 'Subscriber Cross Site Scripting', indicating that a logged-in Subscriber-level account is required to plant the payload, yet the CVSS vector encodes PR:N (no privileges). This PR:N is almost certainly a Patchstack scoring convention rather than a true unauthenticated condition - verify with the Patchstack advisory; realistically at least a low-privileged authenticated account is needed. No EPSS score, no CISA KEV listing, and no public exploit were provided, so this is no public exploit identified at time of analysis. SSVC-style reading: exploitation is not observed, the technical impact is partial (low CIA), and while XSS is often automatable, the requirement for a Subscriber account and victim interaction (UI:R) reduces mass-exploitation likelihood. Overall this is a moderate, defense-in-depth priority - a real but bounded XSS in a niche plugin, not a high-urgency network RCE despite the 7.1 headline.

An attacker registers or obtains a low-privileged Subscriber account on a WordPress site running Branda <= 3.4.32 and submits input containing a malicious script payload through a plugin field that is insufficiently sanitized. When a higher-privileged user such as an administrator later views that content in wp-admin, the script executes in their authenticated browser session, enabling session/cookie theft or admin actions in the victim's context. No public proof-of-concept was provided in the intelligence supplied.