Stored Cross-Site Scripting Vulnerability in Generic Elements Plugin for WordPress

CVE-2025-9080

What is CVE-2025-9080?

The Generic Elements plugin for WordPress is susceptible to Stored Cross-Site Scripting (XSS) vulnerabilities due to inadequate input sanitization and output escaping on various user-defined attributes within widget fields. This issue allows authenticated attackers with contributor-level access or higher to inject malicious web scripts into pages. When users access these compromised pages, the injected scripts execute in their browsers, potentially leading to unauthorized actions or data exposure.

References