What is the CVSS score of CVE-2026-1379?

CVE-2026-1379 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

HTTP Headers WordPress Plugin CVE-2026-1379

EUVD-2026-24634 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-22 Wordfence

GHSA-8h43-r57g-hmff

XSS WordPress

4.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.4 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 22, 2026 - 09:58 vuln.today

EUVD ID Assigned

Apr 22, 2026 - 08:30 euvd

EUVD-2026-24634

Analysis Generated

Apr 22, 2026 - 08:30 vuln.today

CVE Published

Apr 22, 2026 - 07:45 nvd

MEDIUM 4.4

DescriptionCVE.org

The HTTP Headers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.19.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

AnalysisAI

Stored cross-site scripting in HTTP Headers plugin for WordPress up to version 1.19.2 allows authenticated administrators to inject arbitrary scripts into admin settings that execute when users access affected pages. This vulnerability is limited to multi-site installations or sites where the unfiltered_html capability has been disabled, significantly reducing real-world exposure. No active exploitation has been publicly reported, and the high privilege requirement (administrator role) narrows the practical attack surface.

Technical ContextAI

The HTTP Headers WordPress plugin fails to properly sanitize and escape user input in its admin settings pages, specifically in the manual.php view file (as evidenced by the plugin code references). This is a classic Stored XSS vulnerability (CWE-79) where malicious JavaScript is persisted in the WordPress database via plugin settings and executed client-side when administrators or other users view the affected settings page. The vulnerability only manifests in multi-site WordPress installations or single-site installations where the unfiltered_html capability has been revoked - configurations where WordPress core prevents non-administrator roles from using the wp_kses_post() function to filter HTML input. In standard single-site WordPress with default permissions, unfiltered_html is typically available to administrators, allowing them to intentionally use HTML/script tags, which mitigates the risk of accidental injection.

RemediationAI

Update the HTTP Headers plugin to version 1.19.3 or later when released by the vendor, which should include proper input sanitization and output escaping in the admin settings views. In the interim, administrators should restrict access to the HTTP Headers plugin settings page (wp-admin/options-general.php?page=http_headers or equivalent) to only trusted administrators using role-based access control plugins such as Role Manager or Members. For multi-site administrators, consider temporarily disabling the plugin if it is not actively in use until a patch is available. Additionally, review WordPress user roles and capabilities to ensure unfiltered_html is revoked only where necessary (typically for contributor and editor roles), as this was identified as a limiting factor for the vulnerability. No compensating controls can fully mitigate Stored XSS once an authenticated administrator has injected the payload; patches or disabling the plugin are the only reliable fixes. Monitor the official plugin repository (https://plugins.trac.wordpress.org/browser/http-headers/) and Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/02e63068-02a8-4106-b64e-430c24815e55) for patch availability notifications.