WordPress security changelog
MEDIUM CVE-2026-12869 Deferred

Header Footer Builder for Elementor: A security weakness

Header Footer Builder for Elementor is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is < 1.2.1.

CVE / CNA score 6.1 CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
NVD score Pending NVD has not published its own CVSS assessment.
Component
Header Footer Builder for Elementor
Plugin slug
header-footer-builder-for-elementor
Affected
< 1.2.1
Safe version
1.2.1
Published
Jul 16, 2026
Weakness
CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

This CVE was published Jul 16, 2026 and is one of 1 known issue for this plugin.

What to do

Patch or disable the affected component.

Update Header Footer Builder for Elementor to 1.2.1 or later, or disable and remove it until a fixed version is available.

Source record

Technical description

The Header Footer Builder for Elementor WordPress plugin before 1.2.1 does not require an administrative capability for its dashboard template-import action (it allows any edit_posts user), so a Contributor can import a template containing an Elementor HTML widget configured to display site-wide, injecting JavaScript that executes in the session of any visitor or administrator who loads the site.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

Primary and upstream sources