CVE-2026-15394 Overview
CVE-2026-15394 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting the Header Footer Script Adder – Insert Code in Header, Body & Footer plugin for WordPress. The flaw exists in all versions up to and including 2.1. The plugin fails to properly sanitize input and escape output for the asm_code Snippet Meta field. Authenticated users with author-level access or higher can inject arbitrary JavaScript that executes when other users view injected pages.
Critical Impact
Authenticated attackers with author-level privileges can inject persistent scripts that execute in any visitor's browser context, enabling session hijacking, credential theft, and administrative account takeover.
Affected Products
- Header Footer Script Adder – Insert Code in Header, Body & Footer plugin for WordPress
- All versions up to and including 2.1
- Pro edition components (class-pro-admin.php, class-pro-public.php)
Discovery Timeline
- 2026-07-23 - CVE-2026-15394 published to NVD
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-15394
Vulnerability Analysis
The vulnerability resides in the plugin's handling of the asm_code Snippet Meta parameter. The plugin stores user-supplied script content intended for insertion into page headers, bodies, and footers. Because the plugin does not sanitize this input on save and does not escape it on output, attacker-controlled JavaScript is rendered directly into the page markup.
The exploitation path is stored (persistent) XSS. An attacker with author-level access creates or edits a snippet containing malicious JavaScript through the asm_code field. When any user, including administrators, subsequently visits a page where the snippet is rendered, the payload executes in that user's browser.
Because the scope metric is Changed, the injected script can affect resources beyond the vulnerable component, such as the WordPress administrative interface and any authenticated session context loaded on the affected pages.
Root Cause
The root cause is insufficient input sanitization combined with missing output escaping in the plugin's Pro edition. Code review of the vulnerable version references handlers in pro/class-pro-admin.php and pro/class-pro-public.php, where the asm_code value is persisted and later emitted without applying WordPress escaping functions such as esc_html(), esc_attr(), or wp_kses().
Attack Vector
Exploitation requires an authenticated session with author-level privileges or higher. The attacker submits a crafted snippet containing JavaScript into the asm_code field via the plugin's admin interface. The payload is stored in the database and rendered on frontend pages associated with the snippet. Any user, including higher-privileged administrators, who accesses those pages triggers script execution under the site's origin.
See the Wordfence Vulnerability Analysis and the WordPress Plugin Changeset for the specific code locations and the applied fix.
Detection Methods for CVE-2026-15394
Indicators of Compromise
- Unexpected <script> tags, event handlers, or obfuscated JavaScript stored in snippet records associated with the Header Footer Script Adder plugin.
- New or modified author-level user accounts that recently created or edited snippets.
- Outbound requests from visitor browsers to unfamiliar domains referenced by injected payloads.
Detection Strategies
- Audit the WordPress database for snippet meta entries containing asm_code values with script tags, javascript: URIs, or DOM event handlers such as onerror and onload.
- Review WordPress access logs for POST requests to plugin admin endpoints handling snippet creation and updates from non-administrator accounts.
- Compare the plugin's installed version against 2.1 and correlate with recent snippet modifications.
Monitoring Recommendations
- Monitor Content Security Policy (CSP) violation reports for inline script executions on pages that host plugin-rendered snippets.
- Alert on authenticated author-level users accessing or modifying snippet configuration outside of expected editorial workflows.
- Track browser-side telemetry for suspicious script activity originating from WordPress-hosted pages.
How to Mitigate CVE-2026-15394
Immediate Actions Required
- Update the Header Footer Script Adder plugin to the version released after 2.1 that includes the fix committed in changeset 3611085.
- Audit all existing snippets for unexpected JavaScript in the asm_code field and remove any suspicious entries.
- Review author-level and higher user accounts, disabling any that are unused or unrecognized.
Patch Information
The vendor addressed the vulnerability in the plugin repository. Refer to the WordPress Plugin Changeset for the applied fix, which introduces sanitization and escaping around the asm_code Snippet Meta handling in class-pro-admin.php and class-pro-public.php.
Workarounds
- Restrict snippet creation and editing to trusted administrator accounts by revoking the capability from author-level roles until the patched version is applied.
- Deploy a Web Application Firewall (WAF) rule that inspects requests to the plugin's admin endpoints for script tags and JavaScript event handlers in the asm_code parameter.
- Enforce a strict Content Security Policy that disallows inline scripts on frontend pages rendered by the plugin.
# Configuration example: restrict snippet capabilities via WP-CLI
wp cap remove author edit_others_posts
wp cap remove author publish_posts
wp plugin update header-and-footer-script-adder
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
