Header Footer Code Manager
Header Footer Code Manager has 4 disclosed vulnerabilities in the WordSec catalog, reported between 2021 and 2023; all 4 are fixed as of September 2026. Their average CVSS score is 6.2, and the most serious one scores 7.2 out of 10. Severity breakdown: 0 critical and 1 high. 2022 was the busiest year with 2 disclosures.
The most common weakness is Cross-Site Scripting, behind 2 of the records (50%). Other recurring categories include Cross-Site Request Forgery (CSRF), SQL Injection.
Every one of the 4 issues recorded for Header Footer Code Manager has a vendor fix available, so running the current release closes all known holes.
4 independent researchers contributed these findings, one record each. Header Footer Code Manager is installed on roughly 600,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.
CVE-2021-24791Header Footer Code Manager <= 1.1.13 - Authenticated SQL Injections
Read the full analysisVulnerability Records
Header Footer Code Manager
Author
DraftPress Team
Header Footer Code Manager by 99 Robots is a easy interface to add snippets to the header or footer or above or below the content of your page. BENEFITS Never have to worry about inadvertently breaking your site by adding code Avoid inadvertently placing snippets in the wrong place Eliminate the need for a dozen or more silly plugins just to add a small code snippet – Less plugins is always better! Never lose your code snippets when switching or changing themes Know exactly which snippets are loading on your site, where they display, and who added them FEATURES Add an unlimited number of scripts and styles anywhere and on any post / page Manage which posts or pages the script loads Supports custom post types Supports ability to load only on a specific post or page, or latest posts Control where exactly on the page the script is loaded – head, footer, before content, or after content Script can load only on desktops or mobile. Enable or disable one or the other. Use shortcodes to manually place the code anywhere Label every snippet for easy reference Plugin logs which user added and last edited the snippet, and when PAGE DISPLAY OPTIONS Site wide on every post / page Specific post Specific page Specific category Specific tag Specific custom post type Latest posts only (you choose how many) Manually place using shortcodes INJECTION LOCATIONS Head section Footer Top of content Bottom of content DEVICE OPTIONS Show on All Devices Only Desktop Only Mobile Devices SUPPORTED SERVICES Google Analytics Google Adsense Google Tag Manager Clicky Web Analytics or other analytics tracking scripts Chat modules such as Olark, Drip, or Pinterest site verification Facebook Pixels, Facebook Scripts, Facebook og:image Tag Google Conversion Pixels Twitter Heatmaps from Crazy Egg, notification bars Hello Bar, etc. It can accept ANY code snippet (HTML / Javascript / CSS) from any service and the list goes on and on… MULTISITE NOTE If using this plugin on a multisite network, please make sure that the plugin is activated on a subsite level only. Plugin Information Plugin Site Plugin Documentation Free Plugins on WordPress.org Premium Plugins
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C