The Insert Headers and Footers Code – HT Script plugin for WordPress is vulnerable to stored cross‑site scripting because it lacks proper capability checks when saving scripts in the header and footer options. Authenticated users with Author‑level access or higher can inject arbitrary HTML or JavaScript that is persisted in the plugin’s configuration. When other site visitors load a page that includes the injected header or footer, the malicious script runs in their browsers, potentially stealing credentials, hijacking sessions, or defacing content.

All WordPress installations that have the Insert Headers and Footers Code – HT Script plugin installed in versions up to and including 1.1.6 are affected. The plugin is commonly used on sites that allow authors to add custom scripts to the page header or footer.

The vulnerability has a CVSS score of 6.4, indicating moderate severity, and an EPSS score of less than 1 %, suggesting a low likelihood of widespread exploitation at this time. It is not listed in the CISA KEV catalog. Exploitation requires only author‑level access on the target WordPress site, a relatively common privilege level, which means any site with multiple authors could be vulnerable. If an attacker successfully injects malicious scripts, they can compromise the confidentiality and integrity of site visitors’ data and potentially spread worms via the injected code.