CVE-2026-12869

CVSS Score & Metrics

Base Score

6.1 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N                                    

Vulnerability Description

The Header Footer Builder for Elementor WordPress plugin before 1.2.1 does not require an administrative capability for its dashboard template-import action (it allows any edit_posts user), so a Contributor can import a template containing an Elementor HTML widget configured to display site-wide, injecting JavaScript that executes in the session of any visitor or administrator who loads the site.

Vulnerability Details

Published Date

July 16, 2026

Last Modified

July 16, 2026

CWE ID

CWE-79

Source

NVD

Vendor

Unknown

Product

Header Footer Builder for Elementor

External References

https://wpscan.com/vulnerability/3c6562d9-f55e-4d82-be95-60e82a6feecf/

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment