Security Alert Summary
The OPEN-BRAIN WordPress plugin contains a stored cross-site scripting (XSS) vulnerability in its API Key settings field that affects all versions up to, and including, 0.5.0. Insufficient input sanitization and missing escaping when outputting the stored value into an HTML input value attribute allow authenticated administrators to inject scripts that execute when a user views the plugin settings page.
CVE Details
- CVE ID:
CVE-2026-3995 - Affected component: OPEN-BRAIN plugin for WordPress
- Affected versions: all versions up to, and including, 0.5.0
- Published: April 16, 2026 at 7:16:30 AM UTC
- Last modified: April 16, 2026 at 7:16:30 AM UTC
- CVSS v3.1: Base score 4.4 (MEDIUM) – Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
- Authentication / Privileges / User interaction: Privileges required: HIGH (administrator-level authenticated user); User interaction: NONE; Attack vector: NETWORK; Attack complexity: HIGH
- Impact: Confidentiality: LOW; Integrity: LOW; Availability: NONE
- Weakness: CWE-79
Technical Details
The plugin saves the API key value using update_option() after filtering input with sanitize_text_field(). While sanitize_text_field() strips HTML tags, it does not encode double quotes or other HTML-special characters required for safe output inside attribute contexts. The stored value is later echoed into an HTML input element’s value attribute without using esc_attr(), allowing attribute breakout payloads (for example, a double quote followed by an event handler) that execute when a user opens the plugin settings page. This is a stored XSS vulnerability that arises from insufficient output escaping in the attribute context.
How This Could Impact Your Website
In a realistic scenario, an authenticated administrator or a compromised administrator account could enter a crafted payload into the API Key field. When another administrator, site owner, internal staff member, or external contractor visits the plugin settings page, the injected script can run in their browser context. Practical consequences include limited disclosure of information accessible to the viewing user (consistent with the CVSS impact ratings), such as leaking data visible in the browser or performing actions available to that user session, and an increased risk of targeted phishing or social engineering based on exposed information or UI changes. If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review of your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributors and administrators.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins.
- Monitor site activity and logs for unusual behavior, especially access to plugin settings pages.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/open-brain/tags/0.5.0/index.php#L128
- https://plugins.trac.wordpress.org/browser/open-brain/tags/0.5.0/index.php#L252
- https://plugins.trac.wordpress.org/browser/open-brain/tags/0.5.0/index.php#L253
- https://plugins.trac.wordpress.org/browser/open-brain/tags/0.5.0/index.php#L272
- https://plugins.trac.wordpress.org/browser/open-brain/trunk/index.php#L128
- https://plugins.trac.wordpress.org/browser/open-brain/trunk/index.php#L252
- https://plugins.trac.wordpress.org/browser/open-brain/trunk/index.php#L253
- https://plugins.trac.wordpress.org/browser/open-brain/trunk/index.php#L272
- https://www.wordfence.com/threat-intel/vulnerabilities/id/3fe3fa95-cc1d-469b-8a97-37987b9ae362?source=cve
