Skip to content
OpenAdvisories
Medium · 6.5 CVE-2025-31091 EUVD-2025-14789GHSA-7v4x-r9g8-7qx7

WordPress CM Header and Footer plugin <= 1.2.4 - Cross Site Scripting (XSS) Vulnerability

Published Apr 3, 2025 · Updated Apr 28, 2026 · Assigned by Patchstack

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM Header and Footer cm-header-footer-script-loader allows Stored XSS.This issue affects CM Header and Footer: from n/a through <= 1.2.4.

Affected products

VendorProductAffectedFixed
CreativeMindsSolutions CM Header and Footer ≤ 1.2.4 —

References