Header and Footer Scripts

Header and Footer Scripts has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.

The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).

The one issue recorded for Header and Footer Scripts has a vendor fix available, so running the current release closes it.

All of these findings were reported by Powpy. Header and Footer Scripts is installed on roughly 200,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.

Strategic Overview

Avg CVSSMedium

6.4/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Header and Footer Scripts vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.4CVE-2025-11453

Header and Footer Scripts <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

1 records


2026-01-08 21:20	Header and Footer Scripts <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting Header and Footer Scripts <= 2.3.0	`CVE-2025-11453`	6.4 Medium	Powpy	Yes

Showing 1–1 of 1 reports

Latestv2.4.2

Header and Footer Scripts

Author

Anand Kumar

4.6(58)

92/100

Last Updated

2026-02-01 (7mo ago)

Active Installs

200,000+

Downloads

1,732,159

Requires WP

4.6+

Requires PHP

5.6+

Tested up to

WP 6.9.7

Created

2014-02-20 (13y ago)

An essential WordPress plugin to easily insert scripts and styles (like Google Analytics, CSS, etc.) into your website’s header and footer. Looking for a way to add Google Analytics, Facebook Pixel, or custom tracking code to your website’s header or footer? Header and Footer Scripts is a simple yet powerful plugin that lets you inject code—such as Google Analytics, custom CSS, Facebook Pixel, and chat widgets—directly into your site’s header (<head>) or footer. No bloat, no ads. This lightweight plugin simply does what it says: inserts code into your header and footer efficiently. All you have to do is add the appropriate HTML code. Don’t forget to wrap your code with proper tags. <script type="text/javascript"> YOUR JS CODE HERE </script> Or for CSS: <style type="text/css"> YOUR CSS CODE HERE </style> Why use this plugin: Insert scripts globally into the header and footer of your entire website. Supports all script types including HTML, JavaScript, and CSS. Add specific scripts to the header of individual posts or pages. To insert code to Custom Post Type [New Feature]. The plugin should be compatible with WooCommerce. What it does not offer You can’t insert/execute PHP codes. Almost all WordPress themes support this “Header and Footer Scripts” plugin. If the codes are not appearing in your site [ask for support] or look at your theme file if they have standard wp_head and wp_footer hooks. Important Links For further information you are welcomed to follow these links: Read Documentation Get Support GitHub Repository

View on WordPress.org