EUVD-2026-51744
GHSA-vxv6-p94x-jpx2
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Stored XSS requires a victim user to visit the injected page (UI:R); PR:L reflects mandatory contributor authentication; S:C captures cross-browser-context script execution.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The GenerateBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Dynamic Tag Injection in HTML Attributes in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A Contributor-level attacker can store the malicious payload by placing a dynamic tag such as {{post_meta key:...}} in a non-URL HTML attribute (e.g., title, aria-label, alt, or data-* attributes) of a GenerateBlocks element block, then setting the corresponding unprotected post meta key via the Custom Fields metabox to a value containing a closing quote and an injected event-handler attribute.
AnalysisAI
Stored Cross-Site Scripting in the GenerateBlocks WordPress plugin (all versions through 2.3.0) allows authenticated contributors to permanently inject malicious JavaScript into published pages by exploiting unsanitized dynamic tag rendering in non-URL HTML attributes. An attacker with contributor-level WordPress access can chain a dynamic tag placeholder (e.g., {{post_meta key:...}}) in an element attribute with a crafted post meta value containing attribute-breaking syntax, causing script execution in the browser of any subsequent visitor. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the detailed technical disclosure from Wordfence lowers the bar for independent exploitation.
Technical ContextAI
GenerateBlocks is a WordPress page-builder plugin (CPE: cpe:2.3:a:edge22:generateblocks:*:*:*:*:*:*:*:*) that supports dynamic content rendering via a template-tag system (e.g., {{post_meta key:...}}). The vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation) originates in the dynamic tag resolution pipeline across at least four files: class-register-dynamic-tag.php (L196), functions.php (L2145), class-dynamic-tag-callbacks.php (L388), and general.php (L689). When a dynamic tag is resolved inside a non-URL HTML attribute (title, aria-label, alt, data-* attributes), the resolved value is interpolated into the rendered HTML without adequate output escaping, enabling attribute context injection. Setting the referenced post meta key to a value such as x" onmouseover="alert(1) breaks out of the attribute and injects an event handler, which persists in the stored page content and fires each time a visitor loads that page. The scope change (S:C in CVSS) reflects that the attacker's payload executes in the security context of the victim's browser session, not the server.
RemediationAI
An upstream code fix has been committed to the plugin's SVN repository (changeset 3625942 at plugins.trac.wordpress.org), but a specific patched release version number is not explicitly confirmed in the available data - administrators should update to the latest available GenerateBlocks version from the WordPress plugin repository and verify the installed version is newer than 2.3.0. As a compensating control while patching is pending, site administrators can restrict the capability to create or edit posts with Custom Fields (the post_meta mechanism) to trusted roles only (Editor or Administrator), which removes the attack surface since the exploit depends on a contributor setting an arbitrary post meta value via the Custom Fields metabox. Additionally, disabling the GenerateBlocks dynamic tag feature in site configuration, if operationally feasible, eliminates the injection vector entirely. The trade-off of the capability restriction is that legitimate contributors lose the ability to use Custom Fields, which may affect editorial workflows. Audit existing pages using GenerateBlocks elements for dynamic tags in non-URL attributes populated from post meta, particularly title, aria-label, alt, and data-* attributes.
More in Generateblocks
View allThe GenerateBlocks WordPress plugin before 1.4.0 does not validate the generateblocks/container block's tagName attribut
GenerateBlocks plugin for WordPress up to version 2.2.0 fails to verify object-level authorization on the /wp-json/gener
Stored XSS in the GenerateBlocks WordPress plugin (all versions through 2.2.1) allows contributor-level authenticated at
The GenerateBlocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and inclu
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today