zinoui vulnerabilities and threats

CVE-2026-4132 is a high-severity vulnerability in the zinoui HTTP Headers WordPress plugin up to version 1.19.2. It allows authenticated administrators to write arbitrary content, including PHP code, to arbitrary file paths on the server due to insufficient validation and sanitization of file path and username inputs. This can lead to remote code execution. No official patch or remediation guidance is currently available from the vendor.

CVE-2026-2717 is a medium severity vulnerability affecting the zinoui HTTP Headers WordPress plugin up to version 1.19.2. It involves improper neutralization of CRLF sequences, allowing authenticated administrators to inject newline characters and arbitrary Apache directives into the . htaccess file. This injection can cause Apache configuration parse errors and potentially lead to site-wide denial of service. The vulnerability arises from insufficient sanitization of custom header names and values before writing to the . htaccess file via the insert_with_markers() function. No official patch or remediation guidance is currently available.

CVE-2026-1379 is a stored cross-site scripting (XSS) vulnerability in the zinoui HTTP Headers plugin for WordPress, affecting versions up to and including 1.19.2. The flaw arises from insufficient input sanitization and output escaping in admin settings, allowing authenticated administrators to inject arbitrary scripts. This vulnerability only impacts multi-site WordPress installations or those with unfiltered_html disabled. Exploitation results in script execution when users access the injected pages. The vulnerability has a medium severity with a CVSS score of 4.4. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.