Stored Cross-Site Scripting Vulnerability in OPEN-BRAIN Plugin for WordPress

CVE-2026-3995

What is CVE-2026-3995?

The OPEN-BRAIN plugin for WordPress contains a vulnerability that allows authenticated attackers with Administrator-level access to exploit the 'API Key' settings field due to inadequate input sanitization. The plugin relies on sanitize_text_field() to remove HTML tags but fails to adequately encode other special characters, leading to potential XSS attacks. As a result, when the API key is stored via update_option() and later rendered within an HTML input element without proper escaping, malicious scripts could be injected. This occurs whenever a user visits the plugin settings page, potentially compromising site security.

References