CVE-2024-13900

MEDIUM

Head, Footer and Post Injections <= 3.3.0 - Authenticated PHP Code Injection

Title source: llm
STIX 2.1

Description

The Head, Footer and Post Injections plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 3.3.0. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject PHP Code in multisite environments.

References (2)

Core 2

Scores

CVSS v3 4.1
EPSS 0.0038
EPSS Percentile 30.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-94
Status published
Products (2)
satollo/Head, Footer and Post Injections < 3.3.0
satollo/head\,_footer\,_and_post_injections < 3.3.1
Published Feb 21, 2025
Tracked Since Feb 18, 2026