CVE-2026-9756

The GenerateBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Headline Block 'linkMetaFieldType' Dynamic Link Attribute in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A contributor-level attacker can store a JavaScript payload in their own profile description (allowlisted by get_safe_user_meta_keys()) and prepend 'javascript:' via the linkMetaFieldType attribute, creating a fully attacker-controlled href that executes when any user, including an administrator, clicks the rendered headline link.

• CWE-79

• https://plugins.trac.wordpress.org/browser/generateblocks/tags/2.2.0/includes/blocks/class-headline.php#L809
• https://plugins.trac.wordpress.org/browser/generateblocks/tags/2.2.0/includes/class-dynamic-content.php#L816
• https://plugins.trac.wordpress.org/browser/generateblocks/tags/2.2.0/includes/class-dynamic-tag-security.php#L582
• https://plugins.trac.wordpress.org/browser/generateblocks/tags/2.2.1/includes/blocks/class-headline.php#L809
• https://plugins.trac.wordpress.org/browser/generateblocks/tags/2.2.1/includes/class-dynamic-content.php#L816
• https://plugins.trac.wordpress.org/browser/generateblocks/tags/2.2.1/includes/class-dynamic-tag-security.php#L582
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3582036%40generateblocks&new=3582036%40generateblocks&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/aac15273-0a5d-4107-8249-7fff7f503005?source=cve

Published

Jul 3, 2026

Last Modified

Jul 6, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-9749This issue can occur when running an aggregation pipeline th…7.1
• CVE-2026-9750An authenticated user can cause a MongoDB server to crash or…7.1
• CVE-2026-9751The ldapQueryPassword parameter, when set through the runtim…6.8
• CVE-2026-9752An authorized user could trigger a server crash by running a…7.1
• CVE-2026-9753The $_internalApplyOplogUpdate aggregation pipeline stage ca…8.1
• CVE-2026-9754An authenticated user with the read role may read limited am…7.1
• CVE-2026-9757The GEO my WP plugin for WordPress is vulnerable to SQL Inje…7.5
• CVE-2026-9758Improper comparison with the certificates trusted list in S2…7.3
• CVE-2026-9759ROHC protocol dissector crash in Wireshark 4.6.0 to 4.6.5 an…5.5
• CVE-2026-9762IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is …7.8
• CVE-2026-9765Note: The CVE and blog post don't exist because we determine…7.1
• CVE-2026-9770Kasa EC71 v4 and EC70 v4 firmware contains a static cryptogr…5.3