PT-2026-33279 · Faridsaniee · Open-Brain

Published

2026-04-16

·

Updated

2026-04-16

·

CVE-2026-3995

CVSS v3.1

4.4

Medium

AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
The OPEN-BRAIN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'API Key' settings field in all versions up to, and including, 0.5.0. This is due to insufficient input sanitization and output escaping. The plugin uses sanitize text field() which strips HTML tags but does not encode double quotes or other HTML-special characters needed for safe attribute context output. The API key value is saved via update option() and later output into an HTML input element's value attribute without esc attr() escaping. This makes it possible for authenticated attackers, with Administrator-level access, to inject arbitrary web scripts via attribute breakout payloads (e.g., double quotes followed by event handlers) that execute whenever a user accesses the plugin settings page.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-3995

Affected Products

Open-Brain