The General Options plugin for WordPress contains a stored cross‑site scripting flaw that allows an administrator‑level user to embed arbitrary JavaScript in the settings page. The vulnerability arises because the plugin uses sanitize_text_field() when outputting the ad_contact_number field, which removes HTML tags but fails to encode double‑quote characters. When the stored value is placed inside an HTML attribute without proper encoding, an injected quote terminates the attribute and exposes a script victim. An attacker can exploit this to run malicious code in the browser context of any administrator who visits the settings page, potentially compromising credentials, modifying site content, or performing further attacks.

The flaw affects the General Options plugin version 1.1.0 and earlier. This plugin is distributed via the WordPress plugin repository and is installed by WordPress sites that use the plugin. All sites running any of these affected versions with an Administrator role or higher are vulnerable. If a site uses an earlier or later version, the issue is not present. The vulnerability applies only to environments where the plugin is active and the ad_contact_number field is used.

The CVSS score of 4.4 places the flaw in the moderate range. Because the EPSS score is not available, an exact probability of exploitation cannot be determined, but the flaw requires authentication with administrator privileges, a role that is generally restricted. The vulnerability is not listed in the CISA KEV catalog, indicating it has not been widely observed in the wild yet. Nevertheless, any script injected into the admin settings page will execute automatically for administrators who visit, giving the attacker a direct attack surface within the trusted administrative environment.