Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.4

OPEN-BRAIN plugin for WordPress allows malicious scripts to run on administrator's page

CVE-2026-3995
Summary

The OPEN-BRAIN plugin for WordPress is not properly protecting its settings page, allowing an attacker with administrator access to inject malicious scripts. This could lead to unauthorized actions or data theft. Update the plugin to version 0.5.1 or later to fix this issue.

Original title
The OPEN-BRAIN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'API Key' settings field in all versions up to, and including, 0.5.0. This is due to insufficient input sani...
Original description
The OPEN-BRAIN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'API Key' settings field in all versions up to, and including, 0.5.0. This is due to insufficient input sanitization and output escaping. The plugin uses sanitize_text_field() which strips HTML tags but does not encode double quotes or other HTML-special characters needed for safe attribute context output. The API key value is saved via update_option() and later output into an HTML input element's value attribute without esc_attr() escaping. This makes it possible for authenticated attackers, with Administrator-level access, to inject arbitrary web scripts via attribute breakout payloads (e.g., double quotes followed by event handlers) that execute whenever a user accesses the plugin settings page.
nvd CVSS3.1 4.4
Vulnerability type
CWE-79 Cross-site Scripting (XSS)
Published: 16 Apr 2026 · Updated: 16 Apr 2026 · First seen: 16 Apr 2026