HTTP Headers <= 1.19.2 - Authenticated (Administrator+) External Control of File Name or Path to RCE via 'hh_htpasswd_path' and 'hh_www_authenticate_user' Parameters
high
The HTTP Headers plugin for WordPress is vulnerable to External Control of File Name or Path leading to Remote Code Execution in all versions up to and including 1.19.2. This is due to insufficient validation of the file path stored in the 'hh_htpasswd_path' option and lack of sanitization on the 'hh_www_authenticate_u...
- CVSS:
- 7.2
- Affected:
- up to 1.19.2
- Fix:
- No patched version reported
- Disclosed:
- Apr 21, 2026
CVE-2026-4132 on NVD →
HTTP Headers <= 1.19.2 - Authenticated (Administrator+) CRLF Injection via Custom Header Values
medium
The HTTP Headers plugin for WordPress is vulnerable to CRLF Injection in all versions up to, and including, 1.19.2. This is due to insufficient sanitization of custom header name and value fields before writing them to the Apache .htaccess file via `insert_with_markers()`. This makes it possible for authenticated attac...
- CVSS:
- 5.5
- Affected:
- up to 1.19.2
- Fix:
- No patched version reported
- Disclosed:
- Apr 21, 2026
CVE-2026-2717 on NVD →
HTTP Headers <= 1.19.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Custom Headers' Plugin Setting
medium
The HTTP Headers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.19.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arb...
- CVSS:
- 4.4
- Affected:
- up to 1.19.4
- Fixed in:
- 1.19.5
- Disclosed:
- Apr 21, 2026
CVE-2026-1379 on NVD →
HTTP Headers <= 1.18.11 - Server-Side Request Forgery
medium
The HTTP Headers plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.18.11 via the ajax-inspect.php file. This can allow authenticated attackers with admin access to make web requests to arbitrary locations originating from the web application and can be used to query a...
- CVSS:
- 5.5
- Affected:
- up to 1.18.11
- Fixed in:
- 1.19.0
- Disclosed:
- Jul 13, 2023
CVE-2023-37978 on NVD →
HTTP Headers <= 1.18.11 - Authenticated (Administrator+) Stored Cross-Site Scripting
medium
The HTTP Headers for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 1.18.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web...
- CVSS:
- 4.4
- Affected:
- up to 1.18.11
- Fixed in:
- 1.19.0
- Disclosed:
- Jul 10, 2023
CVE-2023-37874 on NVD →
HTTP Headers <= 1.18.10 - Authenticated(Administrator+) Remote Code Execution
medium
The HTTP Headers plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 1.18.10 via the 'http_headers_pre_update_option' function. This allows authenticated attackers with administrator-level permissions to write files and execute code on the server. The issue was partially fixed...
- CVSS:
- 6.6
- Affected:
- up to 1.18.10
- Fixed in:
- 1.18.11
- Disclosed:
- Jun 19, 2023
CVE-2023-1208 on NVD →
HTTP Headers <= 1.18.8 - Authenticated(Administrator+) SQL Injection
medium
The HTTP Headers plugin for WordPress is vulnerable to SQL Injection via the 'http_headers_post_import' and 'http_headers_post_export' functions in versions up to, and including, 1.18.8 due to insufficient escaping on the user supplied parameters and lack of sufficient preparation on the existing SQL query. This makes...
- CVSS:
- 6.6
- Affected:
- up to 1.18.8
- Fixed in:
- 1.18.9
- Disclosed:
- Apr 24, 2023
CVE-2023-1207 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database