Business Name Generator
Monthly
Stored cross-site scripting in the Business Name Generator WordPress plugin through version 1.3 allows an authenticated high-privilege user (administrator) to inject malicious script into the plugin's unsanitised settings fields, which then executes when a second privileged user renders the affected settings page. Publicly available exploit code exists, but exploitation is tightly constrained: it requires high privileges, victim interaction, and a configuration where the unfiltered_html capability is withheld from admins, chiefly WordPress multisite networks, making this a low-priority, high-CVSS-noise-floor issue rather than a genuine threat. No vendor-released patch was identified at time of analysis.
Stored cross-site scripting in the Business Name Generator WordPress plugin through version 1.3 allows an authenticated high-privilege user (administrator) to inject malicious script into the plugin's unsanitised settings fields, which then executes when a second privileged user renders the affected settings page. Publicly available exploit code exists, but exploitation is tightly constrained: it requires high privileges, victim interaction, and a configuration where the unfiltered_html capability is withheld from admins, chiefly WordPress multisite networks, making this a low-priority, high-CVSS-noise-floor issue rather than a genuine threat. No vendor-released patch was identified at time of analysis.