CyberRota Analysis
AI-GeneratedThe Business Name Generator plugin for WordPress versions up to 1.3 is vulnerable due to inadequate sanitization and escaping of certain settings, enabling high-privilege users, such as administrators, to execute Stored Cross-Site Scripting (XSS) attacks, even in environments where unfiltered HTML is restricted. This vulnerability poses a significant risk to sites using the plugin, particularly those in multisite configurations. WordPress administrators and security teams should prioritize patching or mitigating this vulnerability to protect against potential exploitation.
Original NVD Description
The Business Name Generator WordPress plugin through 1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).