What is the CVSS score of CVE-2026-9756?

CVE-2026-9756 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

GenerateBlocks CVE-2026-9756

EUVD-2026-41522 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-03 Wordfence

GHSA-735g-4w2p-c7c6

WordPress XSS Generateblocks Wordpress Plugin Edge22

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Description requires victim to click the headline link (UI:R not UI:N); scope change retained as contributor payload executes in admin session; C:L/I:L reflect limited but real cross-user impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 03, 2026 - 09:16 vuln.today

CVE Published

Jul 03, 2026 - 07:53 cve.org

MEDIUM 6.4

DescriptionCVE.org

The GenerateBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Headline Block 'linkMetaFieldType' Dynamic Link Attribute in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A contributor-level attacker can store a JavaScript payload in their own profile description (allowlisted by get_safe_user_meta_keys()) and prepend 'javascript:' via the linkMetaFieldType attribute, creating a fully attacker-controlled href that executes when any user, including an administrator, clicks the rendered headline link.

AnalysisAI

Stored XSS in the GenerateBlocks WordPress plugin (all versions through 2.2.1) allows contributor-level authenticated attackers to inject arbitrary JavaScript via the Headline Block's linkMetaFieldType dynamic link attribute, executing in the browser of any user - including site administrators - who clicks the injected headline link. The attack chains a get_safe_user_meta_keys() allowlist bypass with insufficient URI scheme validation to construct a fully attacker-controlled javascript: href. No CISA KEV listing exists at time of analysis, but Wordfence reporting and direct source code references lower the barrier to independent exploitation.

Technical ContextAI

GenerateBlocks (CPE: cpe:2.3:a:edge22:generateblocks) is a WordPress Gutenberg page-builder plugin. The Headline Block supports dynamic link resolution via the linkMetaFieldType attribute, which fetches URLs from WordPress user meta fields at render time. The vulnerability originates across three files: class-headline.php (L809) constructs the href without URI scheme validation, class-dynamic-content.php (L816) resolves the meta field value without sanitization, and class-dynamic-tag-security.php (L582) implements get_safe_user_meta_keys() which allowlists certain profile meta fields - including the contributor's own profile description - as safe input sources. The root cause (CWE-79) is the absence of esc_url() or equivalent scheme-aware escaping on the resolved meta value before it is emitted as an href, allowing javascript: URIs to pass through unmodified and execute in victim browsers.

RemediationAI

Update GenerateBlocks to a version above 2.2.1 by installing the patched release via the WordPress plugin repository; the upstream fix is referenced at https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3582036%40generateblocks&new=3582036%40generateblocks. No exact patched release version number is confirmed in the available data - verify the current release in the WordPress admin dashboard or at wordpress.org/plugins/generateblocks before updating. As a compensating control prior to patching, restrict contributor-level role assignments exclusively to fully trusted users, eliminating the PR:L attack surface entirely; note this may impact multi-author publishing workflows. If the GenerateBlocks Headline Block's dynamic link feature (linkMetaFieldType) is not required operationally, disabling it via plugin settings or a capability filter reduces exposure without a full plugin removal.