CVE-2024-13900CWE-94

Head, Footer and Post Injections <= 3.3.0 - Authenticated (Administrator+) PHP Code Injection in Multisite Environments

Medium · published February 21, 2025

CVSS v3.1
4.1
EPSS
0%
Percentile
34.7
In the wild
Unconfirmed
What it is

The Head, Footer and Post Injections plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 3.3.0. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject PHP Code in multisite environments.

The record
Technical detail
CVSS v3.1
4.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00415 · 34.7th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2025-02-21T11:09Z
EPSS history
Timeline
  • 21 FEB 11:09Z
    Head, Footer and Post Injections <= 3.3.0 - Authenticated (Administrator+) PHP Code Injection in Multisite Environments
    cvelistv5