Business Name Generator CVE-2025-15698

Requires an authenticated high-privilege user (administrator) to inject the payload into the plugin's unsanitised settings fields, and a second privileged user to subsequently render the affected settings page (UI:R). The vulnerability is only security-relevant where the unfiltered_html capability is withheld from admins - chiefly WordPress multisite networks; on a default single-site install an admin already has unfiltered_html and gains nothing. Affected: Business Name Generator plugin versions through 1.3. Limiting factors: high privilege prerequisite, required victim interaction, and the multisite/capability-restricted configuration dependency all sharply narrow real-world exploitability.

This is a low-priority, high-CVSS-noise-floor issue rather than a genuine threat. The CVSS 3.1 base score is only 3.5 (Low) with vector AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N - the PR:H (high privilege) and UI:R (user interaction) metrics are the dominant limiters. Exploitation requires an already-authenticated administrator to save a malicious value into plugin settings, which another privileged user must then view. No EPSS score is provided and the CVE is not in CISA KEV, so there is no evidence of active or automatable exploitation; the only elevated signal is 'publicly available exploit code exists' (WPScan c6aa25a4), which is distinct from active exploitation. The core insight is trust boundary: on a standard single-site WordPress install an administrator already holds the unfiltered_html capability and can inject arbitrary script legitimately, so this flaw adds little there. Its real (still modest) value is in hardened multisite environments where even site admins are denied unfiltered_html - this bug bypasses that restriction. No signals conflict: the CVSS vector, POC-but-no-KEV status, and description are mutually consistent.

In a WordPress multisite network where site administrators are stripped of the unfiltered_html capability, a malicious or compromised site admin enters a JavaScript payload into an unsanitised Business Name Generator settings field. When another privileged user (e.g., a network super-admin) later loads the plugin's settings page, the stored script executes in their browser session, potentially escalating toward network-level control. A public proof-of-concept for this input path is available via WPScan.