HTTP Headers

Explore HTTP Headers vulnerabilities across all versions. Currently tracking 7 known vulnerabilities, including severity, impact, and patch status.

Strategic Overview

Avg CVSSMedium

5.7/ 10

Patch Coverage71%

Open

Fixed

Get automatic notifications for all HTTP Headers vulnerabilities before they are exploited.

Vulnerability Records

7 records


2026-04-21 19:13	HTTP Headers <= 1.19.2 - Authenticated (Administrator+) External Control of File Name or Path to RCE via 'hh_htpasswd_path' and 'hh_www_authenticate_user' Parameters HTTP Headers <= 1.19.2	`CVE-2026-4132`	7.2 High	Chiao-Lin Yu (Steven Meow)	No
2026-04-21 19:13	HTTP Headers <= 1.19.2 - Authenticated (Administrator+) CRLF Injection via Custom Header Values HTTP Headers <= 1.19.2	`CVE-2026-2717`	5.5 Medium	Kai Aizen	No
2026-04-21 19:13	HTTP Headers <= 1.19.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Custom Headers' Plugin Setting HTTP Headers <= 1.19.4	`CVE-2026-1379`	4.4 Medium	Daniel Basta (whizzu)	Yes
2023-07-13 00:00	HTTP Headers <= 1.18.11 - Server-Side Request Forgery HTTP Headers <= 1.18.11	`CVE-2023-37978`	5.5 Medium	emad	Yes
2023-07-10 00:00	HTTP Headers <= 1.18.11 - Authenticated (Administrator+) Stored Cross-Site Scripting HTTP Headers <= 1.18.11	`CVE-2023-37874`	4.4 Medium	emad	Yes
2023-06-19 00:00	HTTP Headers <= 1.18.10 - Authenticated(Administrator+) Remote Code Execution HTTP Headers <= 1.18.10	`CVE-2023-1208`	6.6 Medium	qerogram	Yes
2023-04-24 00:00	HTTP Headers <= 1.18.8 - Authenticated(Administrator+) SQL Injection HTTP Headers <= 1.18.8	`CVE-2023-1207`	6.6 Medium	qerogram	Yes

Showing 1–7 of 7 reports

Latestv1.19.5

HTTP Headers

Author

Dimitar Ivanov

4.3(70)

86/100

Last Updated

2026-04-27 (3mo ago)

Active Installs

50,000+

Downloads

774,608

Requires WP

3.2+

Requires PHP

5.3+

Tested up to

WP 6.9.5

Created

2016-05-10 (10y ago)

HTTP Headers gives your control over the http headers returned by your blog or website. Headers supported by HTTP Headers includes: Access-Control-Allow-Origin Access-Control-Allow-Credentials Access-Control-Max-Age Access-Control-Allow-Methods Access-Control-Allow-Headers Access-Control-Expose-Headers Age Content-Security-Policy Content-Security-Policy-Report-Only Cache-Control Clear-Site-Data Connection Content-Encoding Content-Type Cross-Origin-Embedder-Policy Cross-Origin-Opener-Policy Cross-Origin-Resource-Policy Expect-CT Expires Feature-Policy NEL Permissions-Policy Pragma P3P Referrer-Policy Report-To Strict-Transport-Security Timing-Allow-Origin Vary WWW-Authenticate X-Content-Type-Options X-DNS-Prefetch-Control X-Download-Options X-Frame-Options X-Permitted-Cross-Domain-Policies X-Powered-By X-Robots-Tag X-UA-Compatible X-XSS-Protection

View on WordPress.org