WordPress Plugin Vulnerabilities

Business Name Generator <= 1.3 - Admin+ Stored XSS via Button Color Setting

Description

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Proof of Concept

Affects Plugins

Plugin icon
designbro-business-name-generator
No known fix

References

CVE
CVE-2025-15698

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
3.5 (low)

Miscellaneous

Original Researcher
Nikhil Gavhane
Submitter
Nikhil Gavhane
Verified
Yes
WPVDB ID
c6aa25a4-c795-47e6-9d09-bebe4afc1a08

Timeline

Publicly Published
2026-09-17 (about 2 days ago)
Added
2026-09-17 (about 1 day ago)
Last Updated
2026-09-17 (about 1 day ago)

Other

Published
Title
Published
2024-03-26
Title
Elementor Website Builder Pro < 3.20.2 - Authententicated (Contributor+) Stored Cross-Site Scripting
Published
2023-04-03
Title
Ajax Search Lite < 4.11.1, Pro < 4.26.2 - Reflected Cross-Site Scripting
Published
2024-05-06
Title
Magical Addons For Elementor ( Header Footer Builder, Free Elementor Widgets, Elementor Templates Library ) < 1.1.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via Text Effect Widget
Published
2023-01-19
Title
Amr Shortcode Any Widget <= 4.0 - Contributor+ Stored XSS
Published
2022-08-10
Title
Best Payments Plugin for WP < 4.2.1 - Unauthenticated Stored Cross-Site Scripting