¿Es seguro Insert Headers And Footers?

Qué hace este plugin

• Slug: insert-headers-and-footers
• 3000000+ instalaciones activas

codecode-snippetscssheaderphp

Estado de mantenimiento

• Última versión conocida: 2.3.7
• Requiere PHP: 7.0+
• PHP máximo soportado (analizado): 8.4

Vulnerabilidades conocidas

4 CVEs conocidos registrados para Insert Headers And Footers. Reportadas entre 2023 y 2026.

CVE-2026-8832

The WPCode - Insert Headers and Footers + Custom Code Snippets - WordPress Code Manager plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.3.5 This is due to the 'wpcode' custom post type being registered without a custom capability_type or capability restrictions in the wpcode_register_post_type() function, allowing WordPress core to fall back to standard post capabilities for all creation paths including XML-RPC. This makes it possible for authenticated attackers, with author-level access and above, to create and publish executable PHP snippet posts via XML-RPC wp.newPost, which are then executed server-side via eval() in the run_eval() function when the snippet is rendered through the [wpcode] shortcode.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2023-3524

Update the WordPress WPCode plugin to the latest available version (at least 2.0.13.1). Erwan LR (WPScan) discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress WPCode Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 2.0.13.1.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2023-1624

The WPCode plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.8. This is due to missing or incorrect nonce validation on the maybe_delete_log function. This makes it possible for unauthenticated attackers to delete arbitrary log files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2023-0328

The WPCode plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the ajax_auth_url, store_auth_key, and delete_auth functions in versions up to, and including, 2.0.6. This makes it possible for authenticated attackers with access to edit_posts, such as contributors, to retrieve and update the auth key for the WPCode library.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Cómo solucionarlo

Mantén Insert Headers And Footers actualizado — 2.3.7 es la última versión en wordpress.org, y cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en").

Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.

Alternativas más seguras / más establecidas

• Code Snippets — 1000000+ instalaciones activas — 94/100 (503) — PHP máx. 8.4
• Head & Footer Code — 100000+ instalaciones activas — 100/100 (52) — PHP máx. 8.4
• Simple Custom CSS Plugin — 100000+ instalaciones activas — 94/100 (159)
• Shortcoder — Create Shortcodes for Anything — 100000+ instalaciones activas — 98/100 (226)
• Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts — 60000+ instalaciones activas — 90/100 (221)