CVE-2026-1300

Vulnerability

Overview The Responsive Header plugin for WordPress, versions up to and including 1.0, contains a stored cross-site scripting (XSS) vulnerability. The issue stems from insufficient input sanitization and output escaping on multiple plugin settings parameters. This allows authenticated users with administrator-level access to inject arbitrary web scripts that execute when other users visit affected pages. [1]

Attack

Vector and Exploitation An attacker must have administrator-level privileges on the WordPress installation. The vulnerability is exploitable only in multi-site environments or on single-site installations where the unfiltered_html capability has been disabled for administrators. The injected scripts are stored in the plugin settings and execute in the context of any user who accesses the settings page or other injected areas.

Impact

Successful exploitation enables an attacker to perform actions such as stealing session cookies, redirecting users to malicious sites, or defacing the site. Because the attack requires admin-level access, its impact is primarily on lower-privileged users who visit the affected pages, or on the overall security posture of the site.

Mitigation

The plugin has been closed as of January 22, 2026, and is no longer available for download. Users should remove or replace the plugin with an alternative that receives security updates. No patch is available for version 1.0. [1].