CVE-2026-121773: WordPress GenerateBlocks plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerability

Q: What level of access does an attacker need to exploit this issue?

The vulnerability requires low-level privileges. Exploitation also requires user interaction.

Q: Can this be exploited remotely?

Yes. The attack vector is network-based, so an attacker can target an affected site remotely if they have the required privileges.

Q: What is the potential impact of successful exploitation?

Successful stored XSS can affect confidentiality, integrity, and availability at a low impact level. The scope is changed, meaning the vulnerable component can affect other security authorities.

Q: Which versions are affected?

GenerateBlocks versions through 2.5.0 are affected. The available data does not identify a fixed version.

Published Nov 11, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GeneratePress GenerateBlocks generateblocks allows Stored XSS.This issue affects GenerateBlocks: from n/a through 2.5.0.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade wordpress/generateblocks to a version that resolves this vulnerability.
Fixed in 2.5.1

Event History

Nov 11, 2026

CVE Published

via MITRE·11:47 AM

Data Sourced

via MITRE·11:47 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·12:19 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The vulnerability requires low-level privileges. Exploitation also requires user interaction.

Can this be exploited remotely?

Yes. The attack vector is network-based, so an attacker can target an affected site remotely if they have the required privileges.

What is the potential impact of successful exploitation?

Successful stored XSS can affect confidentiality, integrity, and availability at a low impact level. The scope is changed, meaning the vulnerable component can affect other security authorities.

Which versions are affected?

GenerateBlocks versions through 2.5.0 are affected. The available data does not identify a fixed version.

CVE-2026-121773: WordPress GenerateBlocks plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerability

Remediation

Event History

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

Can this be exploited remotely?

What is the potential impact of successful exploitation?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

Can this be exploited remotely?

What is the potential impact of successful exploitation?

Which versions are affected?