CVE-2025-15698

Overview

The Business Name Generator plugin for WordPress, up to version 1.3, contains a vulnerability where configuration settings are not properly sanitized or escaped. This allows high-privileged users to inject malicious scripts into the application's database, which are then executed when the settings page is viewed.

Description

The Business Name Generator WordPress plugin through 1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Impact

This Stored XSS vulnerability impacts the integrity and confidentiality of the administrative interface. It is particularly relevant in WordPress multisite environments where the 'unfiltered_html' capability is disabled, as it allows admins to bypass security restrictions and potentially hijack sessions of other administrators.

Remediation

Update the Business Name Generator plugin to the latest patched version immediately. If a patch is not available, defenders should audit administrative access and consider disabling the plugin in multisite environments where 'unfiltered_html' restrictions are a required security control.

Risk context

The vulnerability is rated as Medium severity with a CVSS score of 3.5. The low EPSS score of 0.00152 suggests a low probability of widespread exploitation in the wild, primarily because it requires high-level administrative privileges to execute.

Affected products

• WordPress
• Business Name Generator Plugin <= 1.3