CVE-2016-10953: Headwaythemes Headway

Medium severity, CVSS 5.4. EPSS: 0.8% chance of exploitation in the next 30 days.

The Headway theme before 3.8.9 for WordPress has XSS via the license key field.

Affected products

• Headwaythemes Headway: before 3.8.9 (fixed in 3.8.9)

Published 2019-09-13. Last modified 2026-06-17.