CVE-2026-1379

The HTTP Headers plugin for WordPress versions up to 1.19.2 contains a Stored Cross-Site Scripting (XSS) vulnerability in the admin settings that results from insufficient input sanitization and output escaping. This vulnerability is limited to multi-site WordPress installations or those with the unfiltered_html capability disabled, restricting its potential impact scope. The vulnerability has a CVSS 3.1 score of 4.4 (MEDIUM severity) with a network-based attack vector, high complexity requirements, and high privilege escalation needs. An authenticated administrator-level attacker could inject arbitrary JavaScript into pages that executes for subsequent users, resulting in limited confidentiality and integrity impacts with no availability risk. There is currently no evidence of active exploitation in the wild, as the vulnerability does not appear on the Known Exploited Vulnerabilities (KEV) catalog and is inactive on threat tracking lists. The EPSS score of 0.00007 indicates minimal probability of exploitation, and community attention remains low, suggesting organizations can prioritize patching according to standard maintenance schedules rather than treating this as an urgent threat.