CVE-2025-15698

LowCVSS 3.5/10Last modified Oct 14, 2026

Description

The Business Name Generator WordPress plugin through 1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Metrics

CVSS 3.1 3.5/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Sep 19, 2026
Last modified
Oct 14, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-15709.8The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to privilege escalatioCVE-2025-157008.8The AWP Classifieds WordPress plugin before 4.4.9 does not validate the type of files extracted from an uploaded ZIP archive during its listCVE-2025-157013.5The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise and escape some of its settings before outputting them on front-end paCVE-2025-157028.8The Cloud Blocks WordPress plugin through 1.1.8 does not perform any authorisation or sanitisation when storing block asset URLs, allowing uCVE-2025-157033.5The HireZoot WordPress plugin before 4.0.0 does not sanitise and escape one of its job specification settings before it is reflected back iCVE-2025-157053.5The Contact Form by Supsystic WordPress plugin before 1.8.0 does not sanitise and escape a form name, allowing users with access to the forCVE-2025-157083.5The Live Composer WordPress plugin before 2.1.23 does not sanitise and escape some of its custom post type slug settings before using them CVE-2025-15715.4The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Animated Text and ImagCVE-2025-157113.5The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its module settings before outputting them in an hrefCVE-2025-157123.5The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its staff member settings before outputting them in pCVE-2025-157133.5The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its page-builder module settings before outputting thCVE-2025-157143.5The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its Button module settings before outputting them on
CVE-2025-15698: Low severity, CVSS 3.5 | Vulnix