WordPress Banner Effect Header version 1.2.6 suffers from a cross site request forgery vulnerability that allows an attacker to inject a cross site scripting attack against the administrator.