CVE-2026-3995 is a stored cross-site scripting vulnerability in the OPEN-BRAIN WordPress plugin up to version 0.5.0. The issue arises from improper neutralization of input during web page generation, specifically in the 'API Key' settings field. The plugin uses sanitize_text_field() for input sanitization, which strips HTML tags but fails to encode double quotes and other special characters required for safe attribute context output. The API key is saved with update_option() and later output into an HTML input element's value attribute without esc_attr() escaping. This allows authenticated users with administrator privileges to inject arbitrary JavaScript via attribute breakout payloads, which execute when the plugin settings page is accessed.

An attacker with administrator-level access can exploit this vulnerability to inject and execute arbitrary JavaScript in the context of the WordPress admin interface. This could lead to actions such as session hijacking, privilege escalation, or other malicious activities within the admin environment. The impact is limited to users who can access the plugin settings page and does not affect unauthenticated users or visitors.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only. Avoid entering untrusted data into the 'API Key' settings field. Monitor for updates from the plugin vendor or WordPress security channels for a patch or official mitigation.