WP Headmaster

WP Headmaster has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it remains unpatched as of September 2026. Their average CVSS score is 6.1, and the most serious one scores 6.1 out of 10.

The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).

The one issue recorded for WP Headmaster has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.

All of these findings were reported by 0xd4rk5id3. WP Headmaster is installed on roughly 200 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 3.7.41.

Strategic Overview

Avg CVSSMedium
6.1/ 10
Patch Coverage0%
Open

1

Fixed

0

Get automatic notifications for all WP Headmaster vulnerabilities before they are exploited.

Most severe open issueCVSS 6.1CVE-2025-22755

WP Headmaster <= 0.3 - Reflected Cross-Site Scripting

Read the full analysis

Vulnerability Records

1 records
Showing 1–1 of 1 reports
WP Headmaster banner
Latestv0.3

WP Headmaster

bavington

Author

bavington

5.0(4)
100/100
Last Updated
2014-02-21 (13y ago)
Active Installs
200+
Downloads
5,623
Requires WP
3.0.1+
Requires PHP
0+
Tested up to
WP 3.7.41
Created
2013-06-13 (13y ago)

WP Headmaster is a free plugin to help correctly include, organise and enqueue common items into your theme’s head tag. WP Headmaster has been designed to work perfectly alongside other popular plugins like Yoast’s WordPress SEO, without any cross-over. WP Headmaster will continue to develop, but at present comes with the following features: Google Analytics – Simply add in your unique tracking ID and select from either Universal or Classic tracking. The GA tracking code will be added last within the head. Page/Post specific CSS and JavaScript – Add inline scripts and styles from a handy Meta Box available on each post and page. Icons – Upload your website’s Favicon and Apple Touch Icon. jQuery – Choose to include jQuery either locally or from Google’s hosted API. Script Library – Enable popular JavaScript files including Respond.js and Modernizr. Inline JavaScript – If you wish to add any inline site-wide JavaScript to your simply include it in the field. Web Fonts – Embed your chosen fonts from Google Web Fonts, Adobe Edge Web Fonts and Typekit. Meta Author Tag – Is dynamically populated with the original author and last to modify the page. You can learn more about WP Headmaster and our other free WordPress plugins on our website. You can also track progress and contribute to WP Headmaster on GitHub.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C