The HTTP Headers WordPress plugin allows administrators to add custom HTTP headers through a settings page. In versions up to 1.19.2, the input for this feature is not properly sanitized or escaped, creating a stored XSS vulnerability. An authenticated attacker with administrator rights can inject malicious scripts that will run whenever any user loads a page on the site. This flaw may lead to credential theft, defacement, or other malicious payload delivery.

The vulnerability exists in the HTTP Headers plugin for WordPress, versions 1.19.2 and earlier. It only applies to multi‑site installations and sites where the "unfiltered_html" capability has been disabled, meaning that administrators can exploit the flaw in such environments.

The CVSS score of 4.4 indicates a moderate severity. Because the flaw requires administrator privileges, the attack surface is limited to users who have compromised or legitimately possess admin rights. No publicly available exploit is documented and the EPSS score is not available, further suggesting a lower likelihood of widespread exploitation. However, the vulnerability is not listed in CISA KEV, so it is not currently flagged in the CISA Known Exploited Vulnerabilities catalog. Attackers would need to log into the WordPress dashboard, edit the Custom Headers setting, and inject malicious JavaScript that is then stored and served to all site visitors.