Insert Headers And Footers Script Vulnerabilities

The Insert Headers and Footers Code – HT Script plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.8. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forge...

CVSS:

4.3

Affected:

up to 1.1.8

Fixed in:

1.1.9

Disclosed:

Jul 27, 2026

CVE-2026-66474 on NVD →

The Insert Headers and Footers Code – HT Script plugin for WordPress is vulnerable to Stored Cross-Site Scripting via adding scripts in all versions up to, and including, 1.1.6 due to insufficient capability checks. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitr...

CVSS:

6.4

Affected:

up to 1.1.6

Fixed in:

1.1.7

Disclosed:

Nov 7, 2025

CVE-2025-12112 on NVD →

The Insert Headers and Footers Code – HT Script plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_dismiss function in all versions up to, and including, 1.1.2. This makes it possible for authenticated attackers, with Subscriber-level access and above,...

CVSS:

6.5

Affected:

up to 1.1.2

Fixed in:

1.1.3

Disclosed:

Apr 1, 2025

CVE-2025-2779 on NVD →