Input validation vulnerability in WooFramework Branding 1.0.1

The WooFramework Branding plugin for WordPress is not secure on versions up to and including 1.0.1. Malicious actors could inject malicious web scripts into pages that then execute if they can successfully trick a user into clicking a link. This is due to a lack of input sanitization and output escaping, and the use of remove_query_arg. Although this is recorded as an Open Redirect in the CVE, it is actually related to Cross-Site Scripting.