Skip to content
Sign in
6.1 Medium

CVE-2026-12869 The Header Footer Builder for Elementor WordPress plugin before 1.2.1 does not require an administrative capability…

Description

The Header Footer Builder for Elementor WordPress plugin before 1.2.1 does not require an administrative capability for its dashboard template-import action (it allows any edit_posts user), so a Contributor can import a template containing an Elementor HTML widget configured to display site-wide, injecting JavaScript that executes in the session of any visitor or administrator who loads the site.

Affected products and versions

Product Affected versions Fixed in
Header Footer Builder for Elementor 1.2 earliest → < 1.2.1 1.2.1
Track this CVE