CVE-2022-0710

🗓️ 24 Feb 2022 18:27:06Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 100 Views🌐 WEB

The Header Footer Code Manager plugin <= 1.1.16 for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) via the $_REQUEST['page'] parameter

Reporter	Title	Published	Views	Family All 15
0day.today	WordPress 99robots Header Footer Code Manager 1.1.16 Cross Site Scripting Vulnerability	22 Feb 202200:00	–	zdt
CNNVD	WordPress plugin 跨站脚本漏洞	22 Feb 202200:00	–	cnnvd
CNVD	WordPress Header Footer Code Manager plugin跨站脚本漏洞	24 Feb 202200:00	–	cnvd
Cvelist	CVE-2022-0710 Header Footer Code Manager <= 1.1.16 Reflected XSS	24 Feb 202218:27	–	cvelist
EUVD	EUVD-2022-15785	3 Oct 202520:07	–	euvd
NVD	CVE-2022-0710	24 Feb 202219:15	–	nvd
OpenVAS	WordPress Header Footer Code Manager Plugin < 1.1.17 XSS Vulnerability	8 Mar 202200:00	–	openvas
Packet Storm	WordPress 99robots Header Footer Code Manager 1.1.16 Cross Site Scripting	22 Feb 202200:00	–	packetstorm
Patchstack	WordPress Header Footer Code Manager plugin <= 1.1.16 - Reflected Cross-Site Scripting (XSS) vulnerability	18 Feb 202200:00	–	patchstack
Prion	Cross site scripting	24 Feb 202219:15	–	prion

NVD

Vulners

Node

draftpress header_footer_code_managerRange≤1.1.16wordpress

[
  {
    "product": "Header Footer Code Manager",
    "vendor": "99robots",
    "versions": [
      {
        "lessThanOrEqual": "1.1.16",
        "status": "affected",
        "version": "1.1.16",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
wordfence	www.wordfence.com/blog/2022/02/reflected-xss-in-header-footer-code-manager/

Parameter	Position	Path	Description	CWE
page	query param	wp-admin/admin.php	Reflected XSS via $_REQUEST['page'] in the admin list page for code snippets (hfcm-list) when a crafted GET parameter is used.	CWE-79

17 Jun 2026 04:21Current

6Medium risk

Vulners AI Score6

CVSS 24.3

CVSS 3.16.1

EPSS0.02389

SSVC

CWE-79