Vulnerabilities

TI-2026-03581 CVE-2026-4132 · GHSA-gg9v-56ph-3gr7

HTTP Headers <= 1.19.2 - Authenticated (Administrator+) External Control of File Name or…

LOW 36

The HTTP Headers plugin for WordPress is vulnerable to External Control of File Name or Path leading to Remote Code Execution in all versions up to and including 1.19.2.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00997 Published 2026-04-22 No fix listed CWE-73

TI-2026-02325 CVE-2026-2717 · GHSA-r256-59w3-3gr2

HTTP Headers <= 1.19.2 - Authenticated (Administrator+) CRLF Injection via Custom Header Values

LOW 25

The HTTP Headers plugin for WordPress is vulnerable to CRLF Injection in all versions up to, and including, 1.19.2.

CVSS 3.1MEDIUM 5.5 Network High privileges No interaction EPSS 0.00474 Published 2026-04-22 No fix listed CWE-93

TI-2026-01081 CVE-2026-1379 · GHSA-8h43-r57g-hmff

HTTP Headers <= 1.19.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Custom Headers' Plugin Setting

LOW 20

The HTTP Headers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.19.2 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 4.4 Network High privileges No interaction EPSS 0.0029 Published 2026-04-22 No fix listed CWE-79

Vulnerabilities

Filters

HTTP Headers <= 1.19.2 - Authenticated (Administrator+) External Control of File Name or…

HTTP Headers <= 1.19.2 - Authenticated (Administrator+) CRLF Injection via Custom Header Values

HTTP Headers <= 1.19.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Custom Headers' Plugin Setting