CVE-2026-6399

{"id": "CVE-2026-6399", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-6399", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-20T13:02:35.305585Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.3}]}, "affected": [{"source": "security@wordfence.com", "affectedData": [{"vendor": "yog2515", "product": "General Options", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.1.0"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-20T02:16:37.920", "references": [{"url": "https://plugins.trac.wordpress.org/browser/general-options/tags/1.1.0/direct-action.php", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/general-options/tags/1.1.0/direct-main.php", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/general-options/trunk/direct-action.php", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/general-options/trunk/direct-main.php", "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d29c69bb-4feb-477e-b18f-934ece21aff6?source=cve", "source": "security@wordfence.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "The General Options plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 1.1.0. This is due to the use of sanitize_text_field() for output escaping in the Contact Number (ad_contact_number) field \u2014 a function that strips HTML tags but does not encode double-quote characters to their HTML entity equivalent ("). When the stored value is echoed inside a double-quoted HTML attribute (value=\"...\"), an attacker-supplied double-quote character breaks out of the attribute context. Even with WordPress's wp_magic_quotes mechanism (which prefixes quotes with a backslash), the resulting \\\" sequence is NOT treated as an escaped quote by HTML parsers \u2014 the backslash is rendered as a literal character and the bare double-quote still closes the attribute. This makes it possible for authenticated attackers with Administrator-level access and above to inject arbitrary web scripts in the admin settings page that will execute whenever any administrator visits the General Options settings page."}, {"lang": "es", "value": "El plugin General Options para WordPress es vulnerable a Cross-Site Scripting Almacenado en versiones hasta la 1.1.0 inclusive. Esto se debe al uso de sanitize_text_field() para el escape de salida en el campo N\u00famero de Contacto (ad_contact_number) - una funci\u00f3n que elimina las etiquetas HTML pero no codifica los caracteres de comillas dobles a su equivalente de entidad HTML (\"). Cuando el valor almacenado se imprime dentro de un atributo HTML entre comillas dobles (value='...'), un car\u00e1cter de comillas dobles proporcionado por el atacante sale del contexto del atributo. Incluso con el mecanismo wp_magic_quotes de WordPress (que antepone una barra invertida a las comillas), la secuencia resultante \\\" NO es tratada como una comilla escapada por los analizadores HTML - la barra invertida se renderiza como un car\u00e1cter literal y la comilla doble sin escapar a\u00fan cierra el atributo. Esto hace posible que atacantes autenticados con acceso de nivel de Administrador o superior inyecten scripts web arbitrarios en la p\u00e1gina de configuraci\u00f3n de administraci\u00f3n que se ejecutar\u00e1n cada vez que cualquier administrador visite la p\u00e1gina de configuraci\u00f3n de General Options."}], "lastModified": "2026-07-24T08:10:00.150", "sourceIdentifier": "security@wordfence.com"}