CVE-2026-6399 is a stored cross-site scripting vulnerability in the yog2515 General Options WordPress plugin affecting versions up to 1.1.0. The issue arises because the Contact Number field uses sanitize_text_field() for output escaping, which does not encode double-quote characters. When this field's value is output inside a double-quoted HTML attribute, an attacker-controlled double-quote can break out of the attribute context, enabling script injection. WordPress's wp_magic_quotes mechanism does not prevent this because the backslash is rendered literally in HTML, failing to escape the quote properly. Only authenticated users with Administrator-level privileges or higher can exploit this vulnerability by injecting malicious scripts that execute when other administrators access the General Options settings page.

An attacker with Administrator-level access can inject arbitrary JavaScript into the General Options plugin's settings page, which executes in the context of other administrators visiting that page. This can lead to limited confidentiality and integrity impacts, such as session hijacking or unauthorized actions performed by administrators. The vulnerability does not affect availability and requires high privileges to exploit. There are no known exploits in the wild at this time.

No official patch or remediation is currently available for this vulnerability. Administrators should exercise caution by limiting the number of users with Administrator privileges and monitoring plugin updates from the vendor for a fix. Since the vulnerability requires Administrator-level access, restricting administrative accounts and reviewing user permissions can reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.