CVE-2025-15698

Deferred Deferred - Pending Action

Stored XSS in Business Name Generator WordPress Plugin

Publication date: 2026-09-19

Last updated on: 2026-09-21

Assigner: WPScan

Description

The Business Name Generator WordPress plugin through 1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-19

Last Modified

2026-09-21

Generated

2026-10-10

AI Q&A

2026-09-20

EPSS Evaluated

2026-10-09

NVD

CVE-2025-15698

Affected Vendors & Products

Vendor	Product	Version / Range
business_name_generator	business_name_generator	to 1.3 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a Stored Cross-Site Scripting (XSS) vulnerability in the Business Name Generator WordPress plugin. It occurs because the plugin does not properly sanitize or escape some of its settings. This allows users with high privileges, such as administrators, to inject malicious scripts that are stored on the server and executed when other users access the affected pages.

Detection Guidance

This vulnerability involves Stored Cross-Site Scripting in the Business Name Generator WordPress plugin. To detect it, inspect the plugin's settings for unsanitized input fields, particularly where user input is stored and rendered without proper escaping. Check for malicious scripts in stored data like post titles or custom fields. Use WordPress admin access to review plugin settings and database entries for suspicious content.

Impact Analysis

If you are an administrator using this plugin, an attacker with admin access could exploit this to run malicious scripts in your browser. This could lead to unauthorized actions, data theft, or session hijacking. Even users with lower privileges could be affected if the injected scripts target them.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate GDPR or HIPAA requirements for data protection and user privacy. Compliance could be impacted if user data is exposed or manipulated due to the XSS attack.

Mitigation Strategies

Update the Business Name Generator WordPress plugin to the latest version immediately to patch the vulnerability.

Hi! I’m here to help you understand CVE-2025-15698. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70