{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-9080", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-08-15T15:44:59.195Z", "datePublished": "2025-10-03T11:17:14.730Z", "dateUpdated": "2026-04-08T17:02:18.437Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:02:18.437Z"}, "affected": [{"vendor": "bdevs", "product": "Generic Elements", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.2.8", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Generic Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widget fields in version 1.2.8 and earlier. This is due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Generic Elements <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7a341a7e-9ed2-436f-846a-59a5d51916fe?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/generic-elements-for-elementor/tags/1.2.4/widgets/FunFactor.php#L692"}, {"url": "https://plugins.trac.wordpress.org/browser/generic-elements-for-elementor/tags/1.2.4/widgets/Slider.php#L1025"}, {"url": "https://plugins.trac.wordpress.org/browser/generic-elements-for-elementor/tags/1.2.8/widgets/CallToAction.php#L1110"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Abu Hurayra"}, {"lang": "en", "type": "finder", "value": "D.Sim"}], "timeline": [{"time": "2025-10-02T22:11:08.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-03T14:56:53.124011Z", "id": "CVE-2025-9080", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-03T14:56:59.307Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-9080", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-03T14:56:53.124011Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-03T14:56:56.031Z"}}], "cna": {"title": "Generic Elements <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "Abu Hurayra"}, {"lang": "en", "type": "finder", "value": "D.Sim"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "bdevs", "product": "Generic Elements", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.2.8"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-02T22:11:08.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7a341a7e-9ed2-436f-846a-59a5d51916fe?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/generic-elements-for-elementor/tags/1.2.4/widgets/FunFactor.php#L692"}, {"url": "https://plugins.trac.wordpress.org/browser/generic-elements-for-elementor/tags/1.2.4/widgets/Slider.php#L1025"}, {"url": "https://plugins.trac.wordpress.org/browser/generic-elements-for-elementor/tags/1.2.8/widgets/CallToAction.php#L1110"}], "descriptions": [{"lang": "en", "value": "The Generic Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widget fields in version 1.2.8 and earlier. This is due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:02:18.437Z"}}}, "cveMetadata": {"cveId": "CVE-2025-9080", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:02:18.437Z", "dateReserved": "2025-08-15T15:44:59.195Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-03T11:17:14.730Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Generic Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widget fields in version 1.2.8 and earlier. This is due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "id": "CVE-2025-9080", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-10-03T12:15:45.690", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/generic-elements-for-elementor/tags/1.2.4/widgets/FunFactor.php#L692"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/generic-elements-for-elementor/tags/1.2.4/widgets/Slider.php#L1025"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/generic-elements-for-elementor/tags/1.2.8/widgets/CallToAction.php#L1110"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7a341a7e-9ed2-436f-846a-59a5d51916fe?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T02:36:05.614494+00:00", "value": {"mitigation_remediation": ["Update the Generic Elements plugin to the latest major release that addresses the XSS flaw.", "Review and cleanse all existing widget content on the site, removing any suspicious or custom script snippets that may have been added after the vulnerability was discovered.", "Restrict contributor access to trusted users only, or promote the role to Editor or higher for users who need to manage widgets with complex content."], "summary": {"action": "Patch", "impact": "Stored Cross\u2011Site Scripting via widget fields"}, "threat_synthesis": {"affected_systems": "All WordPress sites running the Generic Elements plugin, specifically versions 1.2.8 and earlier. Users of the plugin on any WordPress installation are at risk if they have allowed contributors to add or edit widgets. The vulnerability affects the plugin\u2019s widget system and is tied to WordPress\u2019 role\u2011based access control.", "description_and_impact": "The Generic Elements plugin for WordPress is vulnerable because widget fields in versions 1.2.8 and earlier do not properly sanitize and escape user input. This flaw allows an attacker to embed arbitrary JavaScript that is stored server\u2011side and rendered into the page when users view it. Attackers with contributor\u2011level access can inject scripts that execute in the browsers of visitors, potentially stealing session cookies, defacing content, or redirecting traffic, thereby compromising confidentiality and integrity of the site.", "risk_and_exploitability": "The CVSS score of 6.4 indicates a moderate severity. The EPSS score of less than 1% suggests that, while exploitation is not yet common, the attack vector exists and could be leveraged by an authenticated contributor. The issue is not listed in the CISA KEV catalog. The likely attack path involves a contributor logging into the WordPress admin area, inserting malicious code into a widget field, and publishing the page. Any other user who visits that page will then run the injected script."}}}}, "created": "2025-10-06T14:43:12.246286+00:00", "updated": "2026-04-21T02:45:25.944140+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}