CVE-2025-12112
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The Insert Headers and Footers Code – HT Script plugin for WordPress is vulnerable to Stored Cross-Site Scripting via adding scripts in all versions up to, and including, 1.1.6 due to insufficient capability checks. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Risk Assessment
An attacker with Author-level access can inject malicious scripts that execute in other users' browsers, leading to session or data theft.
Recommendation
Upgrade the Insert Headers and Footers Code – HT Script plugin to a version later than 1.1.6 if available, or restrict script addition capability.
Other vulnerabilities in Insert Headers and Footers Code – HT Script
Original NVD description (English source)
The Insert Headers and Footers Code – HT Script plugin for WordPress is vulnerable to Stored Cross-Site Scripting via adding scripts in all versions up to, and including, 1.1.6 due to insufficient capability checks. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS