CVE-2026-66474

MediumCVSS 4.3

Published: 27/07/2026(UTC)Updated: 27/07/2026(UTC)Translated: 27/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.10%

1th percentile - higher than 1% of all known CVEs

Summary

Unauthenticated Cross Site Request Forgery (CSRF) in Insert Headers and Footers Code – HT Script versions up to 1.1.8.

Risk Assessment

An unauthenticated attacker can trick an administrator into performing unwanted actions, such as modifying header or footer code, potentially leading to malicious code injection.

Recommendation

Update the Insert Headers and Footers Code – HT Script plugin to the latest patched version.

Other vulnerabilities in Insert Headers and Footers Code – HT Script

CVE-2025-12112Medium
The Insert Headers and Footers Code – HT Script plugin for WordPress is vulnerable to Stored Cross-Site Scripting via adding scripts in all versions up to, and including, 1.1.6 due to insufficient capability checks. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Original NVD description (English source)

Unauthenticated Cross Site Request Forgery (CSRF) in Insert Headers and Footers Code – HT Script <= 1.1.8 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS