Plugin icon

HTTP Headers

http-headers

Vulnerabilities:

7

Last Updated:

April 27, 2026

Active Installs:

50000

Published
Title
Fixed in
CVSS
Published
2026-04-21
Title
HTTP Headers <= 1.19.2 - Authenticated (Administrator+) External Control of File Name or Path to RCE via 'hh_htpasswd_path' and 'hh_www_authenticate_user' Parameters
Fixed in
No known fix
CVSS
7.2 (high)
Published
2026-04-21
Title
HTTP Headers <= 1.19.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Custom Headers' Plugin Setting
Fixed in
No known fix
CVSS
4.4 (medium)
Published
2026-04-21
Title
HTTP Headers <= 1.19.2 - Administrator+ CRLF Injection via Custom Header Values
Fixed in
No known fix
CVSS
3.8 (low)
Published
2023-07-13
Title
HTTP Headers < 1.19.0 - Admin+ SSRF
Fixed in
Fixed in 1.19.0
CVSS
4.1 (medium)
Published
2023-07-10
Title
HTTP Headers < 1.19.0 - Admin+ Stored XSS
Fixed in
Fixed in 1.19.0
CVSS
3.5 (low)
Published
2023-06-19
Title
HTTP Headers < 1.18.11 - Admin+ Remote Code Execution
Fixed in
Fixed in 1.18.11
CVSS
6.6 (medium)
Published
2023-04-24
Title
HTTP Headers < 1.18.8 - Admin+ SQL Injection
Fixed in
Fixed in 1.18.8
CVSS
6.6 (medium)