Executive brief
The SOGO Add Script to Individual Pages Header Footer WordPress plugin allows contributors and higher-privilege users to inject malicious JavaScript into post custom headers and footers without proper validation. When an administrator reviews the post or visitors view it after publication, the injected script executes in their browsers, potentially allowing attackers to steal admin session cookies, modify page content, or redirect users to malicious sites.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in the plugin's post metabox handler. The plugin fails to sanitize or escape custom header/footer script values when saved via postmeta, and does not restrict access to users with the unfiltered_html capability. An attacker with contributor-level access can close a textarea field using </textarea> and inject arbitrary JavaScript. The payload executes both in the WordPress admin panel when moderators review the post and on the public site once published. The vulnerability affects all versions through 3.9, with no known patch available at the time of this advisory.
Affected products
- SOGO Add Script to Individual Pages Header Footer through 3.9
Timeline
- 2026-08-27: disclosed: Publicly published in WPScan vulnerability database
- 2026-08-20: other: Added to WPVDB
- 2026-08-30: other: Published in NVD