Ajaxify Comments
Monthly
HTTP Header Injection in the Ajaxify Comments WordPress plugin (before version 3.2) allows unauthenticated remote attackers to inject arbitrary HTTP response headers via unsanitized user-supplied input that is echoed into server responses. The plugin fails to neutralize CRLF sequences, enabling response splitting that could facilitate session fixation, cache poisoning, or cross-site scripting via crafted HTTP responses. A publicly available exploit has been documented by WPScan; no active exploitation (CISA KEV) has been confirmed at time of analysis.
HTTP Header Injection in the Ajaxify Comments WordPress plugin (before version 3.2) allows unauthenticated remote attackers to inject arbitrary HTTP response headers via unsanitized user-supplied input that is echoed into server responses. The plugin fails to neutralize CRLF sequences, enabling response splitting that could facilitate session fixation, cache poisoning, or cross-site scripting via crafted HTTP responses. A publicly available exploit has been documented by WPScan; no active exploitation (CISA KEV) has been confirmed at time of analysis.