Answer in brief
CVE-2026-12869 records a Medium severity (CVSS 6.1) vulnerability in Header Footer Builder for Elementor < 1.2.1 - Contributor+ Stored XSS via Template Import. The current sources do not mark it as known exploited. The current feed maps Unknown/Header Footer Builder for Elementor (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Unknown/Header Footer Builder for Elementor (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Unknown/Header Footer Builder for Elementorgeneric | >=0 <1.2.1 | 1.2.1 |
Published upstream
Jul 16, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Jul 16, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 16, 2026
The Header Footer Builder for Elementor WordPress plugin before 1.2.1 does not require an administrative capability for its dashboard template-import action (it allows any edit_posts user), so a Contributor can import a template containing an Elementor HTML widget configured to display site-wide, injecting JavaScript that executes in the session of any visitor or administrator who loads the site.
Quoted source text, attributed separately from HOL analysis.