Simple Header and Footer
Simple Header and Footer has one disclosed vulnerability in the WordSec catalog, all reported in 2024; it is fixed as of October 2026. Their average CVSS score is 6.1, and the most serious one scores 6.1 out of 10.
The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (100%).
The one issue recorded for Simple Header and Footer has a vendor fix available, so running the current release closes it.
All of these findings were reported by SOPROBRO. Simple Header and Footer is installed on roughly 60 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
CVE-2024-53777Simple Header and Footer <= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Read the full analysisVulnerability Records

Simple Header and Footer
Author
Alberto Reineri
Simple Header and Footer lets you add Google Analytics, Facebook Pixel, custom tracking code, verification meta tags and more, with a single straightforward settings page. No need to install a complex plugin with thousands of unnecessary features, and no need to edit your theme files. Header: printed inside the <head> tag. Footer: printed just before the </body> tag. Code editor with syntax highlighting. Your code stays in place when you change or update your theme. A note on security This plugin outputs the HTML and JavaScript you write, exactly as written, on every page of your site. That is what makes it useful for tracking scripts, and it also means the settings page should be treated like access to your theme files. Only users with the unfiltered_html capability (Administrators on a standard install; Super Admins on Multisite) can save raw scripts. Everyone else has their code filtered the same way WordPress filters the Custom HTML block. This plugin does not run PHP code. Privacy and GDPR This plugin does not collect or process any personal user data. The scripts you add may do so: check the privacy requirements of the services you connect. Translation You can contribute to translate this plugin in your language on WordPress Translate.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C