CVE-2025-62082

MediumCVSS 6.5

Published: 09/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

16th percentile - higher than 16% of all known CVEs

Summary

Stored XSS vulnerability in the Generic Elements plugin allows persistent injection of malicious script into the page. An attacker can exploit this to execute script in the victim's browser.

Risk Assessment

Risk of session hijacking, data theft, or unauthorized actions in the victim's context.

Recommendation

Update the Generic Elements plugin to a version newer than 1.2.9 if a patch is available.

Other vulnerabilities in Generic Elements

CVE-2025-9080Medium
The Generic Elements plugin for WordPress version 1.2.8 and earlier is vulnerable to Stored Cross-Site Scripting via multiple widget fields. Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts that execute when a user accesses an injected page.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nasir Uddin Generic Elements generic-elements-for-elementor allows Stored XSS.This issue affects Generic Elements: from n/a through <= 1.2.9.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS