Stored Cross-Site Scripting Vulnerability in GenerateBlocks for WordPress

CVE-2026-13458

What is CVE-2026-13458?

The GenerateBlocks plugin for WordPress has a vulnerability that allows authenticated users with contributor-level access or higher to exploit stored cross-site scripting through insecure handling of dynamic tags. This flaw affects all versions of the plugin up to and including 2.3.0, enabling attackers to inject malicious scripts via non-URL HTML attributes. By manipulating the post meta key through the Custom Fields metabox, an attacker can craft a dynamic tag that leads to the execution of arbitrary web scripts whenever the compromised page is visited.

References