The MG AdvancedOptions plugin for WordPress is vulnerable to reflected cross‑site scripting because it fails to sanitize and escape the $_SERVER['PHP_SELF'] variable in all releases up to 1.2. An unauthenticated attacker can insert arbitrary JavaScript that runs in the victim’s browser when they visit a specially crafted URL or link. The consequence is that the attacker can run code in the context of the victim’s session; the impact is client‑side and does not affect the server.

The vulnerability affects the Mountaingrafix MG AdvancedOptions plugin on WordPress, specifically all versions through and including 1.2. No later versions are noted as affected, and no additional vendors were listed.

The reported CVSS score of 6.1 indicates medium severity. EPSS <1% shows a very low probability of exploitation, and it is not listed in the CISA KEV catalog. An attacker can craft a URL or link that, when followed by an unauthenticated user, triggers execution of injected scripts. No authentication or privileged access is required.