CVE-2026-13458
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
The GenerateBlocks plugin for WordPress is vulnerable to stored cross-site scripting via dynamic tag injection in HTML attributes in all versions up to and including 2.3.0 due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access or above to inject arbitrary web scripts on pages.
Risk Assessment
An attacker can store a malicious payload in HTML attributes (e.g., title, aria-label) of GenerateBlocks block elements, causing scripts to execute when other users view the page. This could lead to session theft, redirects, or other malicious actions on behalf of the victim.
Recommendation
Immediately update the GenerateBlocks plugin to the latest available version that fixes this vulnerability. Also restrict user permissions to the minimum necessary.
Other vulnerabilities in GenerateBlocks
See all- CVE-2026-9756Medium
The GenerateBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Headline Block 'linkMetaFieldType' Dynamic Link Attribute in all versions up to and including 2.2.1 due to insufficient input sanitization and output escaping.
- CVE-2025-11879Medium
The GenerateBlocks plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_option_rest' function in all versions up to, and including, 2.1.1. This makes it possible for authenticated attackers, with contributor level access and above, to read arbitrary WordPress options, including sensitive information such as SMTP credentials, API keys, and other data stored by other plugins.
Original NVD description (English source)
The GenerateBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Dynamic Tag Injection in HTML Attributes in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A Contributor-level attacker can store the malicious payload by placing a dynamic tag such as {{post_meta key:...}} in a non-URL HTML attribute (e.g., title, aria-label, alt, or data-* attributes) of a GenerateBlocks element block, then setting the corresponding unprotected post meta key via the Custom Fields metabox to a value containing a closing quote and an injected event-handler attribute.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS