CVE-2026-9756

Name of the Vulnerable Software and Affected Versions GenerateBlocks versions prior to 2.2.2

Description The GenerateBlocks plugin for WordPress contains a Stored Cross-Site Scripting issue caused by insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages. This is achieved by storing a JavaScript payload in the user profile description and using the linkMetaFieldType attribute to prepend 'javascript:', creating a malicious href that executes when a user, including an administrator, clicks the rendered headline link.

Recommendations Update GenerateBlocks to version 2.2.2 or later.