PT-2026-60420 · WordPress · Elementor Header & Footer Builder

Vaibhav Narkhede · CVE-2026-12869 · Published 2026-07-16 · Updated 2026-07-16

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Header Footer Builder for Elementor versions prior to 1.2.1

Description Insufficient administrative capability requirements for the dashboard template-import action allow users with edit posts permissions, such as Contributors, to import templates. An attacker can include an Elementor HTML widget configured for site-wide display to inject JavaScript that executes in the session of any visitor or administrator who loads the site.

Recommendations Update Header Footer Builder for Elementor to version 1.2.1 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-12869

Affected Products

Elementor Header & Footer Builder

References · 3

• 🔥 https://wpscan.com/vulnerability/3c6562d9-f55e-4d82-be95-60e82a6feecf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-12869 · Security Note
• https://twitter.com/VulmonFeeds/status/2077680033401897265 · Twitter Post