EUVD-2026-47906
GHSA-6gm9-485j-jqr3
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
PR:L confirmed by author-level authentication requirement; S:C reflects payload execution in victim browser scope; C/I:L bounded to session and page integrity impact only.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Header Footer Script Adder - Insert Code in Header, Body & Footer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'asm_code' Snippet Meta in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting in the Header Footer Script Adder WordPress plugin (all versions through 2.1) allows any authenticated user holding author-level access or above to persistently inject arbitrary JavaScript via the 'asm_code' Snippet Meta field. The injected payload executes automatically in the browsers of any user who visits an affected page, enabling session hijacking, credential theft, or malicious redirects across the site's visitor base. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Technical ContextAI
The vulnerability resides in the pro tier of the Header Footer Script Adder WordPress plugin (slug: header-and-footer-script-adder), which allows users to inject arbitrary HTML and JavaScript into page headers, bodies, and footers via configurable snippet meta fields. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS): the 'asm_code' Snippet Meta value is persisted to the WordPress database without adequate sanitization, then rendered into public-facing page output without proper escaping. Specific vulnerable code paths are documented at class-pro-admin.php line 400 (the input/save path) and class-pro-public.php lines 145 and 253 (the output/rendering paths), confirming both the write and read sides of the XSS chain are affected. The CVSS Scope:Changed rating reflects that payload execution occurs in victims' browser security contexts - a distinct security domain from the WordPress server.
RemediationAI
The primary remediation is to update the Header Footer Script Adder plugin to a version that incorporates WordPress SVN changeset 3611085, which addresses the insufficient input sanitization and output escaping of the 'asm_code' Snippet Meta. The exact patched release version number is not explicitly stated in the available data - administrators should verify the current published version in the WordPress plugin repository before updating and confirm it is newer than 2.1. As a compensating control for sites unable to patch immediately, restrict or eliminate author-level (and above) access for untrusted users, as this eliminates the attacker's ability to write snippet payloads. Alternatively, disabling the plugin's code-injection snippet functionality entirely removes the attack surface at the cost of the plugin's core purpose. Wordfence users can reference the advisory at their threat intelligence portal (wordfence.com/threat-intel/vulnerabilities/id/c394c9bc-21f6-45ea-8eda-8ee22a9b87ba) for additional context.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today