Stored Cross-Site Scripting Vulnerability in GenerateBlocks Plugin for WordPress
CVE-2026-9756

6.4MEDIUM

Key Information:

Vendor

WordPress
Status
Generateblocks
Vendor
CVE Published:
3 July 2026

What is CVE-2026-9756?

The GenerateBlocks plugin for WordPress allows authenticated attackers with contributor-level access to exploit a stored cross-site scripting vulnerability. Through the Headline Block's 'linkMetaFieldType' Dynamic Link Attribute, attackers can inject malicious JavaScript code into their profile descriptions. When users, including administrators, access the affected pages, the injected scripts execute, compromising site security and potentially exposing user data.

Affected Version(s)

GenerateBlocks 0 <= 2.2.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/generateblocks...
https://plugins.trac.wordpress.org/browser/generateblocks...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Kirasec
.