HTTP Headers

Vulnerabilities 8Slug http-headersLatest version 1.19.5WordPress.org →

Minimum safe version

1.19.0

Update to 1.19.0 or later to address 5 fixable vulnerabilities

Latest available1.19.5 ✓⚠ 3 vulnerabilities have no fix
Medium 4.4 Unfixed
2026-04-22≤ 1.19.2

HTTP Headers <= 1.19.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Custom Headers' Plugin Setting

CVEWordfencePatchstack
Medium 5.5 Unfixed
2026-04-22≤ 1.19.2

HTTP Headers <= 1.19.2 - Authenticated (Administrator+) CRLF Injection via Custom Header Values

CVEWordfence
High 7.2 Unfixed
2026-04-22≤ 1.19.2

HTTP Headers <= 1.19.2 - Authenticated (Administrator+) External Control of File Name or Path to RCE via 'hh_htpasswd_path' and 'hh_www_authenticate_user' Parameters

CVEWordfence
N/A
2023-07-13< 1.19.0

HTTP Headers <= 1.18.11 - Server-Side Request Forgery

Wordfence