CVE-2026-15394

Name of the Vulnerable Software and Affected Versions Header Footer Script Adder – Insert Code in Header, Body & Footer versions prior to 2.2

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with author-level access and above can inject arbitrary web scripts via the asm code Snippet Meta. These scripts execute whenever a user accesses an affected page.

Recommendations Update to a version newer than 2.1.