Stored Cross-Site Scripting in AddFunc Head & Footer Code Plugin for WordPress
CVE-2026-2305

6.4MEDIUM

Key Information:

Vendor

WordPress
Status
Addfunc Head & Footer Code
Vendor
CVE Published:
10 April 2026

What is CVE-2026-2305?

The AddFunc Head & Footer Code plugin for WordPress is susceptible to stored cross-site scripting attacks due to improper handling of post meta values. This vulnerability arises from the plugin's failure to sanitize or escape the aFhfc_head_code, aFhfc_body_code, and aFhfc_footer_code fields. Authenticated users with Contributor-level access or higher can exploit this weakness to inject malicious scripts into posts, which may execute when administrators view or preview these posts, thereby undermining the security of the WordPress site and potentially affecting its users.

Affected Version(s)

AddFunc Head & Footer Code 0 <= 2.3

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/addfunc-head-f...
https://plugins.trac.wordpress.org/browser/addfunc-head-f...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Muhammad Yudha - DJ
.