Simple Header and Footer
Simple Header and Footer has one disclosed vulnerability in the WordSec catalog, all reported in 2024; it remains unpatched as of September 2026. Their average CVSS score is 6.1, and the most serious one scores 6.1 out of 10.
The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (100%).
The one issue recorded for Simple Header and Footer has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2024.
All of these findings were reported by SOPROBRO. Simple Header and Footer is installed on roughly 50 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.4.10.
CVE-2024-53777Simple Header and Footer <= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Read the full analysisVulnerability Records
Simple Header and Footer
Author
Alberto Reineri
Simple Header and Footer Plugin allows you to add Google Analytics, Facebook Pixel, custom tracking code, and more with a straightforward interface. Avoid installing complex plugins with thousands of unnecessary functionalities After uploading and activating the plugin is possible to add Header and Footer code like this: Translation You can contribute to translate this plugin in your language on WordPress Translate Privacy and GDPR This plugin does not collect or process any personal user data.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C