What is the CVSS score of CVE-2025-62082?

CVE-2025-62082 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

PHP CVE-2025-62082

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-12-09 audit@patchstack.com

WordPress PHP XSS

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Apr 01, 2026 - 15:22 vuln.today

CVE Published

Dec 09, 2025 - 16:18 nvd

MEDIUM 6.5

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nasir Uddin Generic Elements generic-elements-for-elementor allows Stored XSS.This issue affects Generic Elements: from n/a through <= 1.2.9.

AnalysisAI

Stored cross-site scripting (XSS) in Generic Elements for Elementor plugin versions 1.2.9 and earlier allows authenticated users with limited privileges to inject malicious scripts that execute in the context of other users' browsers, potentially leading to session hijacking, credential theft, or malware distribution. The vulnerability requires user interaction (clicking a malicious link) and affects WordPress installations using this plugin. EPSS exploitation probability is low at 0.04%, and no public exploit code or active exploitation has been identified.

Technical ContextAI

The vulnerability stems from improper input sanitization during web page generation in the Generic Elements for Elementor plugin, a WordPress page builder extension. The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), which indicates that user-supplied input is not adequately escaped or validated before being reflected in dynamically generated HTML content. The plugin's handling of element properties or user input through Elementor's interface fails to neutralize XSS payloads, allowing attackers to store malicious JavaScript within the WordPress database. When other users view pages containing these injected elements, the stored XSS payload executes in their browsers with their privileges, assuming they are authenticated.

Affected ProductsAI

Generic Elements for Elementor plugin by Nasir Uddin is affected in all versions from an unspecified baseline through 1.2.9. The plugin is distributed via WordPress.org plugin repository and is commonly used in WordPress installations extending Elementor's page builder functionality with additional custom elements. The affected version range includes at least 1.2.8 and 1.2.9 as confirmed in the Patchstack vulnerability database reference.

RemediationAI

Update Generic Elements for Elementor plugin to version 1.2.10 or later, which includes input sanitization fixes. Navigate to the WordPress admin dashboard, go to Plugins > Installed Plugins, locate Generic Elements for Elementor, and click Update if available, or deactivate and remove the plugin if no patched version is available for your WordPress environment. After updating, audit any pages created with this plugin for suspicious content and review user access logs to identify whether the vulnerability was exploited. The vendor advisory and patch details are available at https://patchstack.com/database/Wordpress/Plugin/generic-elements-for-elementor/vulnerability/wordpress-generic-elements-plugin-1-2-8-cross-site-scripting-xss-vulnerability.