HTTP Headers

Information

Software Type	Plugin
Software Slug	http-headers (view on wordpress.org)
Software Status	Active
Software Author	zinoui
Software Website	github.com
Software Downloads	772,154
Software Active Installs	50,000
Software Record Last Updated	July 18, 2026

7 Vulnerabilities

Submit a Vulnerability

HTTP Headers <= 1.19.2 - Authenticated (Administrator+) External Control of File Name or Path to RCE via 'hh_htpasswd_path' and 'hh_www_authenticate_user' Parameters

7.2

CVE-2026-4132

Apr 21, 2026

Researcher: Chiao-Lin Yu (Steven Meow)

HTTP Headers <= 1.19.2 - Authenticated (Administrator+) CRLF Injection via Custom Header Values

5.5

CVE-2026-2717

Apr 21, 2026

Researcher: Kai Aizen

HTTP Headers <= 1.19.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Custom Headers' Plugin Setting

4.4

CVE-2026-1379

Apr 21, 2026

Researcher: Daniel Basta (whizzu)

HTTP Headers <= 1.18.11 - Server-Side Request Forgery

5.5

CVE-2023-37978

Jul 13, 2023

Researcher: emad

HTTP Headers <= 1.18.11 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVE-2023-37874

Jul 10, 2023

Researcher: emad

HTTP Headers <= 1.18.10 - Authenticated(Administrator+) Remote Code Execution

6.6

CVE-2023-1208

Jun 19, 2023

Researcher: qerogram

HTTP Headers <= 1.18.8 - Authenticated(Administrator+) SQL Injection

6.6

CVE-2023-1207

Apr 24, 2023

Researcher: qerogram

Title	Status	CVE ID	CVSS	Researchers	Date
HTTP Headers <= 1.19.2 - Authenticated (Administrator+) External Control of File Name or Path to RCE via 'hh_htpasswd_path' and 'hh_www_authenticate_user' Parameters	Unpatched	CVE-2026-4132	7.2	Chiao-Lin Yu (Steven Meow)	April 21, 2026
HTTP Headers <= 1.19.2 - Authenticated (Administrator+) CRLF Injection via Custom Header Values	Unpatched	CVE-2026-2717	5.5	Kai Aizen	April 21, 2026
HTTP Headers <= 1.19.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Custom Headers' Plugin Setting	Patched	CVE-2026-1379	4.4	Daniel Basta (whizzu)	April 21, 2026
HTTP Headers <= 1.18.11 - Server-Side Request Forgery	Patched	CVE-2023-37978	5.5	emad	July 13, 2023
HTTP Headers <= 1.18.11 - Authenticated (Administrator+) Stored Cross-Site Scripting	Patched	CVE-2023-37874	4.4	emad	July 10, 2023
HTTP Headers <= 1.18.10 - Authenticated(Administrator+) Remote Code Execution	Patched	CVE-2023-1208	6.6	qerogram	June 19, 2023
HTTP Headers <= 1.18.8 - Authenticated(Administrator+) SQL Injection	Patched	CVE-2023-1207	6.6	qerogram	April 24, 2023

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation