CVE-2026-48877
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
The WordPress GenerateBlocks plugin in versions up to 2.1.0 contains an insertion of sensitive information into sent data vulnerability. This may allow an attacker to retrieve embedded sensitive data.
Risk Assessment
Leakage of sensitive information in sent data may expose sensitive data such as tokens or configuration details to an attacker. This could lead to further attacks on the site.
Recommendation
Update the GenerateBlocks plugin to a version later than 2.1.0 when available. Until then, review sent data and remove sensitive information from it.
Other vulnerabilities in GenerateBlocks
See all- CVE-2026-13458Medium
The GenerateBlocks plugin for WordPress is vulnerable to stored cross-site scripting via dynamic tag injection in HTML attributes in all versions up to and including 2.3.0 due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access or above to inject arbitrary web scripts on pages.
- CVE-2026-9756Medium
The GenerateBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Headline Block 'linkMetaFieldType' Dynamic Link Attribute in all versions up to and including 2.2.1 due to insufficient input sanitization and output escaping.
- CVE-2025-11879Medium
The GenerateBlocks plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_option_rest' function in all versions up to, and including, 2.1.1. This makes it possible for authenticated attackers, with contributor level access and above, to read arbitrary WordPress options, including sensitive information such as SMTP credentials, API keys, and other data stored by other plugins.
Original NVD description (English source)
Insertion of Sensitive Information Into Sent Data vulnerability in Tom GenerateBlocks allows Retrieve Embedded Sensitive Data. This issue affects GenerateBlocks: from n/a through 2.1.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS