{"id":18887560,"date":"2026-04-22T08:37:33","date_gmt":"2026-04-22T08:37:33","guid":{"rendered":"https:\/\/wordpress.org\/support\/?post_type=topic&#038;p=18887560"},"modified":"2026-04-22T10:50:45","modified_gmt":"2026-04-22T10:50:45","slug":"xss-issue-reported-by-patchstack","status":"publish","type":"topic","link":"https:\/\/wordpress.org\/support\/topic\/xss-issue-reported-by-patchstack\/","title":{"rendered":"XSS Issue reported by PatchStack"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Hi there,<br \/>I assume this has been reported by PatchStack to you always which is why the plugin is under investigation.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">https:\/\/patchstack.com\/database\/wordpress\/plugin\/http-headers\/vulnerability\/wordpress-http-headers-plugin-1-19-2-authenticated-administrator-stored-cross-site-scripting-vulnerability<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">https:\/\/www.cve.org\/CVERecord?id=CVE-2026-1379<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It appears to be Admins or above who can take advantage of this vulnerability but it would be great to know if it&#8217;s being fixed, otherwise we need to look for an alternative plugin.<\/p>\n","protected":false},"template":"","class_list":["post-18887560","topic","type-topic","status-publish","hentry","topic-tag-xss"],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/18887560","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic"}],"about":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/types\/topic"}],"version-history":[{"count":1,"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/18887560\/revisions"}],"predecessor-version":[{"id":18887707,"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/18887560\/revisions\/18887707"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/media?parent=18887560"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}