EUVD-2026-44878
GHSA-mm7h-qq6c-6h9w
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
PR:L required because exploitation demands a Contributor account with edit_posts; S:C and UI:R reflect victim-browser stored XSS with no availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Header Footer Builder for Elementor WordPress plugin before 1.2.1 does not require an administrative capability for its dashboard template-import action (it allows any edit_posts user), so a Contributor can import a template containing an Elementor HTML widget configured to display site-wide, injecting JavaScript that executes in the session of any visitor or administrator who loads the site.
AnalysisAI
Stored cross-site scripting in the Header Footer Builder for Elementor WordPress plugin before 1.2.1 permits any Contributor-level user to inject persistent JavaScript into every page of the affected site by importing a crafted template through the plugin's dashboard action, which incorrectly requires only edit_posts capability rather than administrator access. Once the malicious Elementor HTML widget is imported with site-wide display scope, the payload executes in the browser of every visitor and administrator who loads the site - enabling session hijacking, credential theft, or admin account takeover. A publicly available exploit exists per WPScan (EUVD-2026-44878); no CISA KEV listing at time of analysis.
Technical ContextAI
The vulnerability resides in a WordPress plugin that extends the Elementor page builder to manage site-wide header and footer regions. The root cause is a broken access control flaw (CWE-79 manifesting from an authorization misconfiguration): the plugin's template-import AJAX action checks only for the edit_posts capability - granted by default to Contributor-level roles - rather than requiring manage_options or a custom administrative capability. Because Elementor HTML widgets accept raw HTML and JavaScript, a Contributor can supply a template payload containing arbitrary script tags. When configured for site-wide header/footer display, the widget renders on every page load, making this a persistent/stored XSS rather than a reflected one. Affected CPE: cpe:2.3:a:unknown:header_footer_builder_for_elementor:*:*:*:*:*:*:*:* (all versions below 1.2.1).
RemediationAI
Upgrade the Header Footer Builder for Elementor plugin to version 1.2.1 or later, which is confirmed as the vendor-released patch addressing the missing capability check. The plugin update is available through the standard WordPress plugin repository and the WPScan advisory at https://wpscan.com/vulnerability/3c6562d9-f55e-4d82-be95-60e82a6feecf/. If immediate patching is not feasible, the most effective compensating control is to audit and remove or demote all Contributor-level accounts, since the flaw is only exploitable by authenticated Contributor-or-above users - note that this may disrupt editorial workflows on multi-author sites. Alternatively, temporarily deactivating the plugin eliminates the attack surface entirely while patching is arranged, at the cost of losing site-wide header/footer functionality rendered by the plugin. Web application firewall rules blocking the specific template-import AJAX action endpoint may reduce risk but are not a substitute for patching, as bypass techniques for WAF-based XSS filters are well-documented.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today