The Elementor Header & Footer Builder plugin for WordPress, part of brainstormforce's Ultimate Addons for Elementor, suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input in the 'hfe_svg_mime_types' function. This allows authenticated attackers with contributor-level permissions or above to inject malicious scripts into pages, which execute when those pages are viewed by users. The vulnerability affects versions up to and including 1.6.28. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and partial impact on confidentiality and integrity but no impact on availability. No patch or vendor advisory is currently available to confirm remediation status.

An attacker with contributor-level or higher permissions can exploit this vulnerability to inject and store malicious scripts within pages. These scripts execute in the context of users who view the affected pages, potentially leading to unauthorized actions or data disclosure limited to the scope of the affected site. The vulnerability impacts confidentiality and integrity but does not affect availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level permissions to trusted users only and consider monitoring or temporarily disabling the affected plugin functionality if feasible. Avoid granting contributor or higher privileges to untrusted users to reduce risk.