Stored Cross-Site Scripting in Responsive Header Plugin for WordPress

CVE-2026-1300

What is CVE-2026-1300?

The Responsive Header plugin for WordPress has a vulnerability that allows authenticated attackers with administrator-level access to exploit multiple plugin settings. The lack of proper input sanitization and output escaping can lead to the injection of arbitrary web scripts. This security issue primarily impacts multi-site installations and those where the 'unfiltered_html' option has been disabled. As a result, any user visiting a vulnerable page could inadvertently execute injected scripts, potentially compromising the overall security of the WordPress site.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References