PT-2026-31860 · WordPress · Addfunc Head & Footer Code

Published 2026-04-10 · Updated 2026-04-19 · CVE-2026-2305

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions AddFunc Head & Footer Code plugin for WordPress versions prior to 2.3

Description The AddFunc Head & Footer Code plugin for WordPress is susceptible to Stored Cross-Site Scripting through the aFhfc head code, aFhfc body code, and aFhfc footer code post meta values. This occurs because the plugin outputs these meta values without proper sanitization or escaping. Although the plugin limits access to its metabox and save handler to administrators using current user can('manage options'), it does not employ register meta() with an auth callback to safeguard these meta keys. This allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts through the WordPress Custom Fields interface, which will execute when an administrator previews or views the post.

Recommendations For versions prior to 2.3, update to a newer version that contains a fix for this vulnerability.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-2305

Affected Products

Addfunc Head & Footer Code

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2026-2305 · Security Note
• https://twitter.com/atomicedgeWAF/status/2045873313092710802 · Twitter Post
• https://plugins.trac.wordpress.org/browser/addfunc-head-footer-code/tags/2.3/addfunc-head-footer-code.php#L74 · Note
• https://plugins.trac.wordpress.org/changeset?old_path=%2Faddfunc-head-footer-code/tags/2.3&new_path=%2Faddfunc-head-footer-code/tags/2.4 · Note
• https://plugins.trac.wordpress.org/browser/addfunc-head-footer-code/trunk/addfunc-head-footer-code.php#L63 · Note
• https://twitter.com/CVEarity/status/2042906835028697541 · Twitter Post
• https://plugins.trac.wordpress.org/browser/addfunc-head-footer-code/tags/2.3/addfunc-head-footer-code.php#L63 · Note
• https://plugins.trac.wordpress.org/browser/addfunc-head-footer-code/trunk/addfunc-head-footer-code.php#L74 · Note
• https://twitter.com/cyberbivash/status/2042484226012966959 · Twitter Post
• https://plugins.trac.wordpress.org/browser/addfunc-head-footer-code/trunk/addfunc-head-footer-code.php#L85 · Note
• https://twitter.com/VulmonFeeds/status/2042523367501148464 · Twitter Post
• https://plugins.trac.wordpress.org/browser/addfunc-head-footer-code/tags/2.3/addfunc-head-footer-code.php#L85 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/2f2d1a67-1d9b-4b73-988e-085eaa7474c6?source=cve · Note
• https://twitter.com/CVEnew/status/2042561768548110800 · Twitter Post