Description

The Business Name Generator WordPress plugin through 1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.5",
  "pubDate": "2026-09-19T07:16:31.313Z",
  "pubdate": "2026-09-19T07:16:31.313Z",
  "executiveSummary": "The Business Name Generator WordPress plugin, in versions through 1.3, contains a Stored Cross-Site Scripting (XSS) vulnerability due to insufficient input sanitization and output escaping within its settings configuration.\nThis vulnerability allows authenticated users with administrative privileges to inject malicious JavaScript payloads into the plugin's settings interface.\nThe vulnerability persists even in environments where the 'unfiltered_html' capability is restricted, such as WordPress multisite installations.\nSuccessful exploitation enables an attacker to execute arbitrary scripts in the context of an administrator's browser session.\nThis can lead to session hijacking, unauthorized administrative actions, or the deployment of further malicious content on the site.\nThe primary risk stems from the lack of strict input validation, which bypasses intended security controls for high-privilege user accounts.",
  "technicalDetails": "The vulnerability originates from a failure to sanitize input fields and escape output data within the settings page of the Business Name Generator plugin. Specifically, the plugin settings allow for user-supplied data to be stored in the WordPress database and subsequently rendered back into the administrative dashboard without adequate security controls.\nThe root cause is the improper handling of user-supplied input during the saving process of plugin configuration settings. Because the plugin fails to implement 'sanitize_text_field' or 'esc_html' / 'esc_attr' functions effectively, arbitrary JavaScript can be injected into the data fields. When these settings are rendered back to the browser in the administrative panel, the browser interprets the injected data as legitimate executable script code rather than plain text.\nThe attack flow follows these steps: 1. An attacker with administrative privileges accesses the vulnerable settings page provided by the plugin. 2. The attacker inputs a crafted JavaScript payload into one of the susceptible configuration fields. 3. Upon saving, the backend accepts the malicious input without validation. 4. When an administrator (or the attacker) views the affected settings page, the browser executes the stored payload.\nThis flaw is particularly significant as it bypasses the 'unfiltered_html' restriction. In many WordPress multisite configurations, the 'unfiltered_html' capability is explicitly stripped from administrators to prevent XSS. However, because this plugin performs the injection through its own internal saving mechanisms rather than through standard post/page content editors, it circumvents these core WordPress safety checks.\nThe impact includes the ability to perform actions on behalf of the administrator, such as modifying plugin settings, creating new administrator accounts, or exfiltrating sensitive session tokens. Furthermore, because the script resides in the database, it will execute every time the settings page is loaded, ensuring persistent cross-site scripting."
}