CVE-2026-13458

Name of the Vulnerable Software and Affected Versions GenerateBlocks versions prior to 2.3.1

Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting (XSS). An attacker can inject arbitrary web scripts by placing a dynamic tag, such as {{post meta key:...}}, into non-URL HTML attributes (including title, aria-label, alt, or data-* attributes) of a block element. The payload is stored by setting the corresponding unprotected post meta key via the Custom Fields metabox to a value containing a closing quote and an injected event-handler attribute, which executes when a user accesses the affected page.

Recommendations Update to a version newer than 2.3.0.