Stored Cross-Site Scripting Vulnerability in Business Name Generator Plugin for WordPress
CVE-2025-15698
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 19 September 2026
Badges
What is CVE-2025-15698?
The Business Name Generator Plugin for WordPress, in versions through 1.3, is susceptible to a stored Cross-Site Scripting vulnerability. This issue arises from the lack of proper sanitization and escaping on certain settings, enabling high privilege users, such as admin, to execute malicious scripts. This vulnerability is particularly concerning in multisite setups where the unfiltered_html capability is typically restricted, making it a critical area for site administrators to address to safeguard their WordPress installations.
Affected Version(s)
Business Name Generator 0 <= 1.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.