Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
The HTTP Headers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.19.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-04-23 | 1 | Disclosure1 |
| 2026-04-24 | 1 | PoC1 |
https://atomicedge.io/cve-proof/cve-2026-1379-http-headers-version-1-19-2-medium-vulnerability-proof-of-concept CVE-2026-1379 #WordPress plugin #vulnerability http-headers #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #atomicedge
Post summary
The tweet shares a link to a proof‑of‑concept for CVE‑2026‑1379, but offers no exploit code, technical details, or patch information.
CVE-2026-1379 The HTTP Headers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.19.2 due to insufficient i… https://www.cve.org/CVERecord?id=CVE-2026-1379
Post summary
The statement announces a stored XSS vulnerability in the WordPress HTTP Headers plugin affecting versions up to 1.19.2, without providing PoC, exploit code, or patch details.