Is CVE-2026-6399 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-6399 being exploited in the wild.

How severe is CVE-2026-6399?

Medium severity, with a CVSS score of 4.4, published 20 May 2026.

Which products and versions are affected?

Wordpress General Options up to and including 1.1.0.

Is there a fix for CVE-2026-6399?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-6399 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-6399?

Check whether you run Wordpress General Options at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-6399: WordPress General Options stored XSS in Contact Number field

CVE-2026-6399 · Severity: medium · CVSS 4.4 · Published 2026-05-20

The General Options plugin for WordPress, which manages site-wide settings, contains a security flaw that allows malicious scripts to be saved in the site's database. An attacker with administrative access could use this to execute code in the browsers of other site administrators when they visit the settings page. This could lead to unauthorized actions being performed on behalf of other high-level users.

Vendors: Wordpress.

Quick answers

Is CVE-2026-6399 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-6399 being exploited in the wild.
How severe is CVE-2026-6399?: Medium severity, with a CVSS score of 4.4, published 20 May 2026.
Which products and versions are affected?: Wordpress General Options up to and including 1.1.0.
Is there a fix for CVE-2026-6399?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-6399 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-6399?: Check whether you run Wordpress General Options at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The General Options plugin for WordPress (up to 1.1.0) is vulnerable to Stored Cross-Site Scripting (XSS) due to the use of sanitize_text_field() for output escaping in the 'ad_contact_number' field. While this function strips HTML tags, it fails to encode double-quote characters. When the stored value is echoed within a double-quoted HTML attribute, an attacker can use a double-quote to break out of the attribute context. Although WordPress's wp_magic_quotes adds a backslash, HTML parsers treat the resulting sequence as a literal backslash followed by a closing quote. This allows authenticated attackers with Administrator-level privileges to inject arbitrary web scripts that execute when any administrator views the plugin's settings page.

Affected products

WordPress Plugin General Options up to and including 1.1.0

Timeline

2026-05-20: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.