https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 27 Oct 2026 10:07:32 +0000 https://cve.radiocsirt.org/vuln/cve-2026-6399 <p><strong>Affected:</strong> yog2515 General Options</p> <p>The General Options plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 1.1.0. This is due to the use of sanitize_text_field() for output escaping in the Contact Number (ad_contact_number) field — a function that strips HTML tags but does not encode double-quote characters to their HTML entity equivalent (&amp;quot;). When the stored value is echoed inside a double-quoted HTML attribute (value=&#34;...&#34;), an attacker-supplied double-quote character breaks out of the attribute context. Even with WordPress&#39;s wp_magic_quotes mechanism (which prefixes quotes with a backslash), the resulting \&#34; sequence is NOT treated as an escaped quote by HTML parsers — the backslash is rendered as a literal character and the bare double-quote still closes the attribute. This makes it possible for authenticated attackers with Administrator-level access and above to inject arbitrary web scripts in the admin settings page that will execute whenever any administrator visits the General Options settings page.</p> <p><strong>Affected:</strong> yog2515 General Options</p> <p>The General Options plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 1.1.0. This is due to the use of sanitize_text_field() for output escaping in the Contact Number (ad_contact_number) field — a function that strips HTML tags but does not encode double-quote characters to their HTML entity equivalent (&amp;quot;). When the stored value is echoed inside a double-quoted HTML attribute (value=&#34;...&#34;), an attacker-supplied double-quote character breaks out of the attribute context. Even with WordPress&#39;s wp_magic_quotes mechanism (which prefixes quotes with a backslash), the resulting \&#34; sequence is NOT treated as an escaped quote by HTML parsers — the backslash is rendered as a literal character and the bare double-quote still closes the attribute. This makes it possible for authenticated attackers with Administrator-level access and above to inject arbitrary web scripts in the admin settings page that will execute whenever any administrator visits the General Options settings page.</p> https://cve.radiocsirt.org/vuln/cve-2026-6399