Vulnerabilities

TI-2023-19410 CVE-2023-37978 · GHSA-4xhm-q9h6-mq38

WordPress HTTP Headers Plugin <= 1.18.11 is vulnerable to Server Side Request Forgery (SSRF)

LOW 23

Server-Side Request Forgery (SSRF) vulnerability in Dimitar Ivanov HTTP Headers.This issue affects HTTP Headers: from n/a through 1.18.11.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00449 Published 2023-11-13 No fix listed CWE-918

TI-2023-19313 CVE-2023-37874 · GHSA-c52j-j2cg-8r59

WordPress HTTP Headers Plugin <= 1.18.11 is vulnerable to Cross Site Scripting (XSS)

LOW 27

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Dimitar Ivanov HTTP Headers plugin <= 1.18.11 versions.

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00396 Published 2023-08-05 No fix listed CWE-79

TI-2023-01142 CVE-2023-1208 · GHSA-g93m-hx8j-2qmq

HTTP Headers < 1.18.11 - Admin+ Remote Code Execution

HIGH 67

This HTTP Headers WordPress plugin before 1.18.11 allows arbitrary data to be written to arbitrary files, leading to a Remote Code Execution vulnerability.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01716 Published 2023-07-10 Fixed in 1.18.11

TI-2023-01141 CVE-2023-1207 · GHSA-qh8g-3pfr-79x6

HTTP Headers < 1.18.8 - Admin+ SQL Injection

HIGH 67

This HTTP Headers WordPress plugin before 1.18.8 has an import functionality which executes arbitrary SQL on the server, leading to an SQL Injection vulnerability.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00885 Published 2023-05-15 Fixed in 1.18.8

Vulnerabilities

Filters

WordPress HTTP Headers Plugin <= 1.18.11 is vulnerable to Server Side Request Forgery (SSRF)

WordPress HTTP Headers Plugin <= 1.18.11 is vulnerable to Cross Site Scripting (XSS)

HTTP Headers < 1.18.11 - Admin+ Remote Code Execution

HTTP Headers < 1.18.8 - Admin+ SQL Injection