{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12112", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-23T15:11:52.238Z", "datePublished": "2025-11-08T03:27:50.117Z", "dateUpdated": "2026-04-08T17:34:11.156Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:34:11.156Z"}, "affected": [{"vendor": "htplugins", "product": "Insert Headers and Footers Code \u2013 HT Script", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.1.6", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Insert Headers and Footers Code \u2013 HT Script plugin for WordPress is vulnerable to Stored Cross-Site Scripting via adding scripts in all versions up to, and including, 1.1.6 due to insufficient capability checks. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Insert Headers and Footers Code \u2013 HT Script <= 1.1.6 - Authenticated (Author+) Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f97ced40-c349-43b4-963f-2a49db4bbd4a?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3387037%40insert-headers-and-footers-script&new=3387037%40insert-headers-and-footers-script&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Athiwat Tiprasaharn"}], "timeline": [{"time": "2025-11-07T15:09:07.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-11-07T14:55:13.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-10T19:46:08.705524Z", "id": "CVE-2025-12112", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-10T19:50:50.311Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12112", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-10T19:46:08.705524Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-10T19:50:45.261Z"}}], "cna": {"title": "Insert Headers and Footers Code \u2013 HT Script <= 1.1.6 - Authenticated (Author+) Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "Athiwat Tiprasaharn"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "htplugins", "product": "Insert Headers and Footers Code \u2013 HT Script", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.1.6"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-07T15:09:07.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-11-07T14:55:13.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f97ced40-c349-43b4-963f-2a49db4bbd4a?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3387037%40insert-headers-and-footers-script&new=3387037%40insert-headers-and-footers-script&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The Insert Headers and Footers Code \u2013 HT Script plugin for WordPress is vulnerable to Stored Cross-Site Scripting via adding scripts in all versions up to, and including, 1.1.6 due to insufficient capability checks. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:34:11.156Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12112", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:34:11.156Z", "dateReserved": "2025-10-23T15:11:52.238Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-08T03:27:50.117Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Insert Headers and Footers Code \u2013 HT Script plugin for WordPress is vulnerable to Stored Cross-Site Scripting via adding scripts in all versions up to, and including, 1.1.6 due to insufficient capability checks. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "id": "CVE-2025-12112", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-11-08T04:15:44.303", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3387037%40insert-headers-and-footers-script&new=3387037%40insert-headers-and-footers-script&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f97ced40-c349-43b4-963f-2a49db4bbd4a?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T18:35:33.170024+00:00", "value": {"mitigation_remediation": ["Update the plugin to the most recent version available from the WordPress plugin repository that resolves the vulnerability.", "If an update is not immediately possible, limit the ability to add or edit header/footer scripts to administrators only or remove the capability for author\u2011level users.", "As a temporary measure, disable or uninstall the Insert Headers and Footers Code \u2013 HT Script plugin until a patched version is released."], "summary": {"action": "Patch Plugin", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "All WordPress installations that have the Insert Headers and Footers Code \u2013 HT Script plugin installed in versions up to and including 1.1.6 are affected. The plugin is commonly used on sites that allow authors to add custom scripts to the page header or footer.", "description_and_impact": "The Insert Headers and Footers Code \u2013 HT Script plugin for WordPress is vulnerable to stored cross\u2011site scripting because it lacks proper capability checks when saving scripts in the header and footer options. Authenticated users with Author\u2011level access or higher can inject arbitrary HTML or JavaScript that is persisted in the plugin\u2019s configuration. When other site visitors load a page that includes the injected header or footer, the malicious script runs in their browsers, potentially stealing credentials, hijacking sessions, or defacing content.", "risk_and_exploitability": "The vulnerability has a CVSS score of 6.4, indicating moderate severity, and an EPSS score of less than 1\u202f%, suggesting a low likelihood of widespread exploitation at this time. It is not listed in the CISA KEV catalog. Exploitation requires only author\u2011level access on the target WordPress site, a relatively common privilege level, which means any site with multiple authors could be vulnerable. If an attacker successfully injects malicious scripts, they can compromise the confidentiality and integrity of site visitors\u2019 data and potentially spread worms via the injected code."}}}}, "created": "2025-11-10T09:33:34.528976+00:00", "updated": "2026-04-21T18:45:06.076851+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}