Input validation vulnerability in WooFramework Branding 1.0.1

The WooFramework Branding plugin for WordPress has a security flaw that can allow unauthenticated attackers to inject malicious web scripts into pages. This flaw affects versions up to and including 1.0.1 and is caused by a lack of proper input sanitation and output escaping, as well as the use of the function remove_query_arg. If a user is tricked into clicking a link, the malicious code can be executed. Note that the CVE has this registered as an Open Redirect, but this patch is related to Cross-Site Scripting.