What is the CVSS score of CVE-2026-3995?

CVE-2026-3995 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-3995?

Yes, a patch is available for CVE-2026-3995. Update the affected software to the latest version immediately.

WordPress CVE-2026-3995

EUVD-2026-23213 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-16 Wordfence

GHSA-xrw6-gwf8-vvr9

XSS WordPress

4.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.4 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch released

Apr 16, 2026 - 14:30 nvd

Patch available

Analysis Generated

Apr 16, 2026 - 07:49 vuln.today

EUVD ID Assigned

Apr 16, 2026 - 07:30 euvd

EUVD-2026-23213

Analysis Generated

Apr 16, 2026 - 07:30 vuln.today

CVE Published

Apr 16, 2026 - 06:44 nvd

MEDIUM 4.4

DescriptionCVE.org

The OPEN-BRAIN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'API Key' settings field in all versions up to, and including, 0.5.0. This is due to insufficient input sanitization and output escaping. The plugin uses sanitize_text_field() which strips HTML tags but does not encode double quotes or other HTML-special characters needed for safe attribute context output. The API key value is saved via update_option() and later output into an HTML input element's value attribute without esc_attr() escaping. This makes it possible for authenticated attackers, with Administrator-level access, to inject arbitrary web scripts via attribute breakout payloads (e.g., double quotes followed by event handlers) that execute whenever a user accesses the plugin settings page.

AnalysisAI

Stored cross-site scripting in OPEN-BRAIN WordPress plugin versions up to 0.5.0 allows authenticated administrators to inject malicious scripts via the API Key settings field, which are executed when any user accesses the plugin settings page. The vulnerability stems from improper use of sanitize_text_field() (which does not prevent attribute breakout) combined with missing esc_attr() escaping when outputting the API key to an HTML input value attribute. While exploitation requires administrator-level access, the stored nature means scripts persist and affect all subsequent user interactions with the settings page.

Technical ContextAI

The OPEN-BRAIN plugin for WordPress implements a settings form that accepts an API Key value through the WordPress options system (update_option). The underlying vulnerability involves two WordPress security functions used incorrectly: sanitize_text_field() strips HTML tags but does not encode HTML-special characters (including double quotes), making it insufficient for attribute context output; esc_attr() is the correct function for escaping output within HTML element attributes. The plugin code at lines 252-253 (input handling) and 272 (output rendering) demonstrates the flaw - the value is sanitized on input but not escaped on output, leaving it vulnerable to attribute breakout payloads. When the API key is rendered into an input element's value attribute without esc_attr(), an attacker can close the attribute with a quote, inject event handlers (e.g., onload=), and execute arbitrary JavaScript. CWE-79 (Improper Neutralization of Input During Web Page Generation) is the root cause class.

RemediationAI

Update the OPEN-BRAIN plugin to a patched version released after 0.5.0 if available; check the WordPress plugin repository and Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/3fe3fa95-cc1d-469b-8a97-37987b9ae362 for the recommended version. If no patch is available, temporarily disable the OPEN-BRAIN plugin until a fixed version is released. As a compensating control, restrict administrator role assignments to trusted users only and monitor administrator account activity for unauthorized settings modifications. Site administrators should also enable WordPress security plugins that log and alert on option changes (update_option events). If the plugin must remain active pending a patch, audit current API Key values in the database (wp_options table, option name likely 'open_brain_api_key' or similar) for any suspicious characters or JavaScript payloads and reset them.