Description

The Header Footer Script Adder – Insert Code in Header, Body & Footer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'asm_code' Snippet Meta in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-07-23T10:16:50.433Z",
  "pubdate": "2026-07-23T10:16:50.433Z",
  "executiveSummary": "The Header Footer Script Adder – Insert Code in Header, Body & Footer plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability affecting all versions up to, and including, 2.1. This security flaw stems from insufficient input sanitization and inadequate output escaping applied to user-supplied data within the 'asm_code' snippet meta component.\nThe vulnerability allows authenticated threat actors possessing author-level access or higher to inject arbitrary web scripts, such as malicious JavaScript payloads, directly into application pages. When targeted end-users or administrators access these injected pages, the malicious script executes within the context of their browser session.\nThe realization of this vulnerability introduces significant risk implications, including potential session hijacking, unauthorized administrative action execution, and defacement of the affected WordPress site. Successful exploitation requires authenticated access with specific privilege requirements, specifically author-level permissions, and relies on user interaction where a victim must visit the compromised page containing the injected script.",
  "technicalDetails": "The vulnerability resides in the handling of the 'asm_code' snippet meta within the Header Footer Script Adder plugin for WordPress, specifically impacting all versions up to, and including, 2.1. The root cause of the flaw is characterized by a failure in input validation and sanitization processes, compounded by a lack of proper context-aware output escaping.\nBecause the application accepts snippet data from authenticated users without properly stripping or neutralizing dangerous HTML markup and JavaScript vectors, malicious payloads can be successfully persisted within the database.\nThe vulnerable component processes the 'asm_code' parameter during snippet creation or modification requests. Attackers possessing author-level access or above can supply crafted HTTP requests containing malicious script payloads destined for storage in the snippet meta fields. Once the server accepts and persists this input without adequate sanitization, the payload is securely stored in the underlying database.\nThe attack flow proceeds as follows: 1) An authenticated attacker with author privileges or higher crafts a malicious script payload targeting the 'asm_code' snippet meta. 2) The attacker submits the payload to the vulnerable plugin component via administrative or dashboard interfaces. 3) The plugin fails to sanitize the input and writes the malicious payload directly to the database. 4) When any user or administrator requests a rendered page that loads the affected script snippet, the application renders the raw payload without output escaping. 5) The browser of the visiting user executes the arbitrary script within the Document Object Model (DOM) of the affected origin.\nPost-exploitation impact includes the execution of arbitrary scripts in the context of other users' sessions, enabling the theft of sensitive session cookies, manipulation of content, or escalation of privileges if an administrative user visits the injected page. Network exposure is inherent to the web application hosting the WordPress instance, and execution relies upon the authentication and authorization prerequisites of author-level access combined with subsequent victim interaction."
}