CVE-2026-102376 in Branda Plugin
Summary
by MITRE • 09/30/2026
Subscriber Cross Site Scripting (XSS) in Branda <= 3.4.32 versions.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified as Subscriber Cross-Site Scripting within the Branda plugin, affecting versions up to and including 3.4.32, represents a significant security risk for WordPress-based websites that utilize this tool for managing multi-site networks and user roles. This flaw is classified under Common Weakness Enumeration (CWE) ID 79, which denotes Improper Neutralization of Input During Web Page Generation commonly known as Cross-Site Scripting. The specific nature of this vulnerability allows an attacker to inject malicious client-side scripts into web pages viewed by other users, leveraging the trust that those users have in the affected application environment.
The technical root cause lies in insufficient input validation and output encoding mechanisms within the Branda plugin's handling of subscriber-level user data or administrative interfaces accessible to subscribers. In a typical WordPress architecture, roles such as Subscriber are intended to have minimal privileges, often restricted from accessing complex administration panels. However, if the application fails to properly sanitize inputs provided by users with this role before processing them for display in an HTML context, it creates an injection point. When a victim user interacts with a crafted URL or form submission containing malicious JavaScript code, the browser executes this script within the security context of the Branda plugin's domain. This bypasses standard same-origin policies because the execution occurs on a trusted page belonging to the target organization’s website.
From an operational perspective, the impact of this vulnerability is severe due to its potential for session hijacking and data exfiltration. An attacker can exploit this flaw to steal administrative cookies or authentication tokens associated with higher-privileged accounts if those sessions are active in the same browser instance as the victim user interacting with the malicious payload. Furthermore, the injected script can perform actions on behalf of the authenticated user without their knowledge, such as changing account settings, modifying site configurations, or redirecting users to phishing sites designed to capture credentials. This undermines the integrity and confidentiality of the web application, potentially leading to full compromise of the WordPress installation if combined with other vulnerabilities or social engineering tactics.
The attack vector is typically categorized under MITRE ATT&CK technique T1059, specifically Command Line Interface or Web Protocol execution via browser-based scripts like JavaScript. It falls within the Initial Access and Execution phases of an adversary's kill chain when used in conjunction with phishing campaigns where victims are tricked into clicking malicious links that trigger the XSS payload. The persistence aspect is limited unless the attacker can store persistent payloads, but even transient executions pose a high risk to user sessions and data privacy.
Mitigation strategies must focus on immediate remediation through software updates and enhanced security configurations. Administrators should upgrade Branda to version 3.4.33 or later where this issue has been addressed by implementing robust input sanitization using WordPress functions like wp_kses_post and ensuring output encoding is applied consistently across all user-facing interfaces. Additionally, enabling Content Security Policy (CSP) headers can significantly reduce the impact of successful XSS attacks by restricting the sources from which scripts are allowed to execute. Regular security audits and penetration testing should be conducted to identify similar input validation gaps in other plugins or themes that interact with subscriber-level data, ensuring a defense-in-depth approach to web application security.