CVE-2025-62082
MEDIUMCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
2Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nasir Uddin Generic Elements generic-elements-for-elementor allows Stored XSS.This issue affects Generic Elements: from n/a through <= 1.2.9.
Analysis
Stored cross-site scripting (XSS) in Generic Elements for Elementor plugin versions 1.2.9 and earlier allows authenticated users with limited privileges to inject malicious scripts that execute in the context of other users' browsers, potentially leading to session hijacking, credential theft, or malware distribution. The vulnerability requires user interaction (clicking a malicious link) and affects WordPress installations using this plugin. EPSS exploitation probability is low at 0.04%, and no public exploit code or active exploitation has been identified.
Technical Context
The vulnerability stems from improper input sanitization during web page generation in the Generic Elements for Elementor plugin, a WordPress page builder extension. The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), which indicates that user-supplied input is not adequately escaped or validated before being reflected in dynamically generated HTML content. The plugin's handling of element properties or user input through Elementor's interface fails to neutralize XSS payloads, allowing attackers to store malicious JavaScript within the WordPress database. When other users view pages containing these injected elements, the stored XSS payload executes in their browsers with their privileges, assuming they are authenticated.
Affected Products
Generic Elements for Elementor plugin by Nasir Uddin is affected in all versions from an unspecified baseline through 1.2.9. The plugin is distributed via WordPress.org plugin repository and is commonly used in WordPress installations extending Elementor's page builder functionality with additional custom elements. The affected version range includes at least 1.2.8 and 1.2.9 as confirmed in the Patchstack vulnerability database reference.
Remediation
Update Generic Elements for Elementor plugin to version 1.2.10 or later, which includes input sanitization fixes. Navigate to the WordPress admin dashboard, go to Plugins > Installed Plugins, locate Generic Elements for Elementor, and click Update if available, or deactivate and remove the plugin if no patched version is available for your WordPress environment. After updating, audit any pages created with this plugin for suspicious content and review user access logs to identify whether the vulnerability was exploited. The vendor advisory and patch details are available at https://patchstack.com/database/Wordpress/Plugin/generic-elements-for-elementor/vulnerability/wordpress-generic-elements-plugin-1-2-8-cross-site-scripting-xss-vulnerability.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today