Admin Options Pages
Admin Options Pages has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it is fixed as of October 2026. Their average CVSS score is 6.1, and the most serious one scores 6.1 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for Admin Options Pages has a vendor fix available, so running the current release closes it.
All of these findings were reported by Dimas Maulana. Admin Options Pages is installed on roughly 500 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
CVE-2025-23905Admin Options Pages <= 0.9.7 - Reflected Cross-Site Scripting
Read the full analysisVulnerability Records

Admin Options Pages
Author
Johannes van Poelgeest
Admin Options Pages is a beautifully designed WordPress plugin, which makes it incredibly easy to create options menus, pages and fields. Whether you are a seasoned developer or just getting started, Admin Options Pages makes it easy for everybody. Build your own settings pages in an editor that feels like WordPress itself, without writing a single line of code. Every value is stored as a normal WordPress option, so you can use it anywhere: in your theme with get_option(), in your content with a shortcode, or in a block. What you can do Build menus, pages and fields in an editor that feels familiar from the first click. Drag pages and fields, or move them with the keyboard, and see problems before you save. Choose from 21 field types, from a simple text field to dates, a range slider, a button group, images and files. Show values on your website without code: bind a block to a field (Block Bindings), or use the shortcode [aop_option name="phone"]. Only the fields you choose are shown. Hand it over to your client. The options pages are native WordPress settings pages. Give a page the Editor access level, and your client can change its values without access to the rest of the settings. Reuse your setup on the next site. Export the menus you choose, with the values of their fields, and import them on another site. You first see what would happen, and nothing is replaced unless you choose it. No lock-in. Your values are normal WordPress options. Deactivate the plugin, and they are still there. Field types Text: Text field, Textarea, Wysiwyg editor, Email, Link, Password Numbers: Number, Range Choices: Checkbox, Radio buttons, Select, Button group Date and time: Date, Time, Date and time Media: Color picker, Image, File Layout: Title, Description, Horizontal rule For developers Read every value with get_option( 'your_field_name' ). Change a value just before it is stored with the filters aop_sanitized_option and aop_sanitized_option_<option name>. Add your own field types with the Field Types API. Translations Admin Options Pages is available in English and comes with Dutch, German, French and Spanish translations. The German, French and Spanish translations are machine-translated. Improvements are welcome on translate.wordpress.org. Documentation Visit adminoptionspages.com/docs for the documentation. Bug reports, tips and ideas Bug reports and ideas are welcome in our issue tracker on GitHub. For “how to” questions, please use the support forum.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C