The 'Head, Footer and Post Injections' WordPress plugin suffers from a PHP code injection vulnerability (CWE-94) in all versions up to 3.3.0. Authenticated attackers with Administrator privileges on multisite WordPress installations can inject arbitrary PHP code, potentially leading to code execution within the context of the web server. The CVSS 3.1 base score is 4.1, reflecting the requirement for high privileges and network access, with limited impact on confidentiality, integrity, and availability.

An attacker with Administrator-level access can inject PHP code, which may allow execution of arbitrary code on the server hosting the WordPress multisite environment. The impact is limited by the requirement for high privileges and no user interaction. Confidentiality, integrity, and availability impacts are rated low to medium based on the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Administrator-level access to trusted users only and monitor multisite environments for unauthorized changes. Avoid installing or updating to vulnerable versions of the plugin. Follow vendor communications for updates on patches or official mitigations.