The Header Footer Builder for Elementor plugin, prior to version 1.2.1, permits a user with the Contributor role to import dashboard templates without requiring administrative privileges. An attacker can craft a template containing an Elementor HTML widget that injects JavaScript configured to run site‑wide. When any visitor or administrator views the site, the malicious script executes in their browser, allowing the attacker to steal session cookies, deface the site, or perform further malicious actions. This behavior reflects a classic stored XSS weakness, identified by CWE‑79.

WordPress installations that have installed Header Footer Builder for Elementor before version 1.2.1 and have contributors with the edit_posts capability are vulnerable. The plugin does not enforce higher‑level permissions for the import function, so any Contributor role user can exploit the flaw.

The CVSS score of 6.1 categorizes the vulnerability as moderate severity. The EPSS score of less than 1% indicates that it is unlikely to be widely exploited at this time, and it is not listed in CISA’s KEV catalog. However, the required conditions—having a Contributor‑level account and the ability to import templates—are commonly found on many sites, so once the flaw is known it could be abused to inject arbitrary JavaScript into user sessions.