PT-2026-34268 · WordPress · Http Headers

Daniel Basta · Published 2026-04-22 · Updated 2026-05-01 · CVE-2026-1379

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions HTTP Headers plugin for WordPress versions prior to 1.19.3

Description Insufficient input sanitization and output escaping in admin settings allow authenticated attackers with administrator-level permissions and above to perform Stored Cross-Site Scripting. This enables the injection of arbitrary web scripts into pages, which execute when a user accesses them. This issue specifically affects multi-site installations and environments where unfiltered html has been disabled.

Recommendations Update the plugin to a version later than 1.19.2.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-1379

Affected Products

Http Headers

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-1379 · Security Note
• https://twitter.com/CVEnew/status/2047428143036907532 · Twitter Post
• https://reddit.com/r/StopBadBots/comments/1t0qbbs/critical_alert_20_unpatched_wordpress · Reddit Post
• https://plugins.trac.wordpress.org/browser/http-headers/trunk/views/manual.php#L18 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/02e63068-02a8-4106-b64e-430c24815e55?source=cve · Note
• https://plugins.trac.wordpress.org/browser/http-headers/tags/1.19.2/views/manual.php#L18 · Note