CVE-2025-15698 is a stored Cross-Site Scripting (CWE-79) vulnerability in the Business Name Generator WordPress plugin versions up to and including 1.3. The vulnerability occurs because the plugin fails to sanitize and escape certain settings, allowing high privilege users like admins to inject malicious scripts. This can happen even when the unfiltered_html capability is disallowed, for example in multisite environments, potentially leading to persistent XSS attacks.

An attacker with high privileges (e.g., administrator) can exploit this vulnerability to perform stored XSS attacks, which may lead to execution of arbitrary JavaScript in the context of the affected site. This can result in session hijacking, defacement, or other malicious actions within the administrative interface or for other users viewing the affected content.

No official patch or fix is currently documented. Users should monitor the vendor or plugin repository for updates addressing this vulnerability. Until a fix is available, restrict administrative access to trusted users only and consider disabling or removing the plugin if possible. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.