The zinoui HTTP Headers WordPress plugin versions up to 1.19.2 suffer from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Authenticated users with administrator-level permissions can inject malicious scripts via the plugin's admin settings. This vulnerability affects only multi-site installations or those with unfiltered_html disabled, enabling persistent script injection that executes when affected pages are viewed. The CVSS 3.1 base score is 4.4 (medium severity), reflecting network attack vector, high attack complexity, required privileges, no user interaction, and partial impact on confidentiality and integrity. No vendor advisory or patch is currently available, and no known exploits have been reported.

An attacker with administrator privileges can inject arbitrary web scripts that execute in the context of users visiting the affected pages, potentially leading to unauthorized actions or data exposure limited to confidentiality and integrity impacts. The vulnerability does not affect availability. The impact is constrained to multi-site WordPress setups or installations with unfiltered_html disabled, limiting the scope of affected environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted users only and consider disabling or removing the zinoui HTTP Headers plugin in multi-site or unfiltered_html-disabled environments. Monitor official zinoui and WordPress security channels for updates.