AddFunc Head & Footer Code

AddFunc Head & Footer Code has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of August 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.

The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).

The one issue recorded for AddFunc Head & Footer Code has a vendor fix available, so running the current release closes it.

All of these findings were reported by Muhammad Yudha - DJ. AddFunc Head & Footer Code is installed on roughly 20,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.

Strategic Overview

Avg CVSSMedium

6.4/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all AddFunc Head & Footer Code vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.4CVE-2026-2305

AddFunc Head & Footer Code <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Fields

Read the full analysis

Vulnerability Records

1 records


2026-04-09 14:51	AddFunc Head & Footer Code <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Fields AddFunc Head & Footer Code <= 2.3	`CVE-2026-2305`	6.4 Medium	Muhammad Yudha - DJ	Yes

Showing 1–1 of 1 reports

Latestv2.5

AddFunc Head & Footer Code

Author

AddFunc

5.0(25)

100/100

Last Updated

2026-04-22 (4mo ago)

Active Installs

20,000+

Downloads

262,963

Requires WP

3.0.1+

Requires PHP

Tested up to

WP 6.9.7

Created

2014-12-01 (12y ago)

Allows administrators to add code to the <head> and/or footer of an individual post (or page or other content) and/or site-wide. Ideal for scripts such as Google Analytics conversion tracking code and any other general or page-specific JavaScript. A very simple, reliable and lightweight plugin.

View on WordPress.org