Executive brief
The General Options plugin for WordPress, which manages site-wide settings, contains a security flaw that allows malicious scripts to be saved in the site's database. An attacker with administrative access could use this to execute code in the browsers of other site administrators when they visit the settings page. This could lead to unauthorized actions being performed on behalf of other high-level users.
Technical details
The General Options plugin for WordPress (up to 1.1.0) is vulnerable to Stored Cross-Site Scripting (XSS) due to the use of sanitize_text_field() for output escaping in the 'ad_contact_number' field. While this function strips HTML tags, it fails to encode double-quote characters. When the stored value is echoed within a double-quoted HTML attribute, an attacker can use a double-quote to break out of the attribute context. Although WordPress's wp_magic_quotes adds a backslash, HTML parsers treat the resulting sequence as a literal backslash followed by a closing quote. This allows authenticated attackers with Administrator-level privileges to inject arbitrary web scripts that execute when any administrator views the plugin's settings page.
Affected products
- WordPress Plugin General Options up to and including 1.1.0
Timeline
- 2026-05-20: advisory: NVD publication date
References
- https://plugins.trac.wordpress.org/browser/general-options/tags/1.1.0/direct-action.php
- https://plugins.trac.wordpress.org/browser/general-options/tags/1.1.0/direct-main.php
- https://plugins.trac.wordpress.org/browser/general-options/trunk/direct-action.php
- https://plugins.trac.wordpress.org/browser/general-options/trunk/direct-main.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/d29c69bb-4feb-477e-b18f-934ece21aff6?source=cve