CVE-2026-12869 is a cross-site scripting (CWE-79) vulnerability in the Header Footer Builder for Elementor WordPress plugin prior to version 1.2.1. The vulnerability arises because the dashboard template-import action does not restrict access to administrators only; it permits any user with the edit_posts capability to import templates. An attacker with Contributor-level permissions can exploit this by importing a malicious template containing an Elementor HTML widget configured to execute JavaScript site-wide. This injected script runs in the session context of any visitor or administrator who loads the affected site, potentially leading to session hijacking or other script-based attacks.

The vulnerability allows users with Contributor-level permissions to inject JavaScript that executes in the browsers of site visitors and administrators. This can lead to unauthorized actions performed in the context of the victim's session, including potential session hijacking, data theft, or other malicious activities enabled by cross-site scripting. The impact is significant because it escalates the ability of lower-privileged users to affect site security and user trust.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict the edit_posts capability to trusted users only or disable the template-import feature for non-administrators to prevent exploitation. Monitor vendor channels for updates and apply any official patches promptly once released.