Riverside
Riverside Http Headers: vulnerabilidades y CVE
Riverside Http Headers tiene 7 vulnerabilidades publicadas, 3 de ellas en los últimos 12 meses. 0 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE7
Últimos 12 meses3
Críticas0
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-4132 | Alta (7.2) | 1.6% | — | 22 abr 2026 | The HTTP Headers plugin for WordPress is vulnerable to External Control of File Name or Path leading to Remote Code Execution in all versions up to and including 1.19.2. This is due to insufficient validation of the… |
| CVE-2026-2717 | Media (5.5) | 0.56% | — | 22 abr 2026 | The HTTP Headers plugin for WordPress is vulnerable to CRLF Injection in all versions up to, and including, 1.19.2. This is due to insufficient sanitization of custom header name and value fields before writing them to… |
| CVE-2026-1379 | Media (4.4) | 0.29% | — | 22 abr 2026 | The HTTP Headers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.19.2 due to insufficient input sanitization and output escaping. This makes… |
| CVE-2023-37978 | Media (4.9) | 0.45% | — | 13 nov 2023 | Server-Side Request Forgery (SSRF) vulnerability in Dimitar Ivanov HTTP Headers.This issue affects HTTP Headers: from n/a through 1.18.11. |
| CVE-2023-37874 | Media (4.8) | 0.40% | — | 5 ago 2023 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Dimitar Ivanov HTTP Headers plugin <= 1.18.11 versions. |
| CVE-2023-1208 | Alta (7.2) | 1.7% | — | 10 jul 2023 | This HTTP Headers WordPress plugin before 1.18.11 allows arbitrary data to be written to arbitrary files, leading to a Remote Code Execution vulnerability. |
| CVE-2023-1207 | Alta (7.2) | 0.89% | — | 15 may 2023 | This HTTP Headers WordPress plugin before 1.18.8 has an import functionality which executes arbitrary SQL on the server, leading to an SQL Injection vulnerability. |