WordPress security by component

HTTP Headers

Plugin description

HTTP Headers is a WordPress component with 7 published CVE records in this archive. The latest tracked vulnerability was published Apr 22, 2026; the highest CVE/CNA score is 7.2.

Plugin slug: http-headers

Latest vulnerability

CVE-2026-4132: HTTP Headers: Code execution

HTTP Headers is affected by code execution. Exploitation requires at least administrator-level access. Successful exploitation can run attacker-controlled code in the WordPress hosting account. The published affected range is <= 1.19.2.

PublishedApr 22, 2026

Known safe version> 1.19.2

		Safe version
Apr 22, 2026	CVE-2026-4132 HTTP Headers: Code execution HTTP Headers is affected by code execution. Exploitation requires at least administrator-level access. Successful exploitation can run attacker-controlled code in the WordPress hosting account. The published affected range is <= 1.19.2.	> 1.19.2	CVE7.2 NVDPending
Apr 22, 2026	CVE-2026-2717 HTTP Headers: A security weakness HTTP Headers is affected by a security weakness. Exploitation requires at least administrator-level access. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 1.19.2.	> 1.19.2	CVE5.5 NVDPending
Apr 22, 2026	CVE-2026-1379 HTTP Headers: Cross-site scripting HTTP Headers is affected by cross-site scripting. Exploitation requires an authenticated WordPress account. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 1.19.2.	> 1.19.2	CVE4.4 NVDPending
Nov 13, 2023	CVE-2023-37978 HTTP Headers: Server-side request forgery HTTP Headers is affected by server-side request forgery. Exposure depends on how the affected operation is made reachable by the site. The vulnerable server can be induced to make attacker-selected network requests.	See mitigation notes	CVE4.4 NVD4.9
Aug 05, 2023	CVE-2023-37874 Http Headers: Cross-site scripting Http Headers is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE5.9 NVD4.8
Jul 10, 2023	CVE-2023-1208 Http Headers: Code execution Http Headers is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.	See mitigation notes	CVE7.2 NVD7.2
May 15, 2023	CVE-2023-1207 Http Headers: SQL injection Http Headers is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVE7.2 NVD7.2