The Generic Elements plugin for WordPress is vulnerable because widget fields in versions 1.2.8 and earlier do not properly sanitize and escape user input. This flaw allows an attacker to embed arbitrary JavaScript that is stored server‑side and rendered into the page when users view it. Attackers with contributor‑level access can inject scripts that execute in the browsers of visitors, potentially stealing session cookies, defacing content, or redirecting traffic, thereby compromising confidentiality and integrity of the site.

All WordPress sites running the Generic Elements plugin, specifically versions 1.2.8 and earlier. Users of the plugin on any WordPress installation are at risk if they have allowed contributors to add or edit widgets. The vulnerability affects the plugin’s widget system and is tied to WordPress’ role‑based access control.

The CVSS score of 6.4 indicates a moderate severity. The EPSS score of less than 1% suggests that, while exploitation is not yet common, the attack vector exists and could be leveraged by an authenticated contributor. The issue is not listed in the CISA KEV catalog. The likely attack path involves a contributor logging into the WordPress admin area, inserting malicious code into a widget field, and publishing the page. Any other user who visits that page will then run the injected script.