CVE-2026-9756
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
The GenerateBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Headline Block 'linkMetaFieldType' Dynamic Link Attribute in all versions up to and including 2.2.1 due to insufficient input sanitization and output escaping.
Risk Assessment
An authenticated attacker with contributor-level access can inject arbitrary JavaScript that executes when an administrator clicks the link, potentially leading to session hijacking or data theft.
Recommendation
Immediately update the GenerateBlocks plugin to the latest available version and restrict user permissions to the minimum necessary.
Other vulnerabilities in GenerateBlocks
See all- CVE-2026-13458Medium
The GenerateBlocks plugin for WordPress is vulnerable to stored cross-site scripting via dynamic tag injection in HTML attributes in all versions up to and including 2.3.0 due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access or above to inject arbitrary web scripts on pages.
- CVE-2025-11879Medium
The GenerateBlocks plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_option_rest' function in all versions up to, and including, 2.1.1. This makes it possible for authenticated attackers, with contributor level access and above, to read arbitrary WordPress options, including sensitive information such as SMTP credentials, API keys, and other data stored by other plugins.
Original NVD description (English source)
The GenerateBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Headline Block 'linkMetaFieldType' Dynamic Link Attribute in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A contributor-level attacker can store a JavaScript payload in their own profile description (allowlisted by get_safe_user_meta_keys()) and prepend 'javascript:' via the linkMetaFieldType attribute, creating a fully attacker-controlled href that executes when any user, including an administrator, clicks the rendered headline link.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS