CVE-2026-9756

🗓️ 03 Jul 2026 07:53:09Reported by WordfenceType

GenerateBlocks up to 2.2.1 has stored XSS via Headline Block linkMetaFieldType, enabling contributors to inject scripts.

Reporter	Title	Published	Views	Family All 6
ATTACKERKB	CVE-2026-9756	3 Jul 202607:53	–	attackerkb
Circl	CVE-2026-9756	3 Jul 202610:17	–	circl
Cvelist	CVE-2026-9756 GenerateBlocks <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Headline Block 'linkMetaFieldType' Dynamic Link Attribute	3 Jul 202607:53	–	cvelist
EUVD	EUVD-2026-41522	3 Jul 202607:53	–	euvd
NVD	CVE-2026-9756	3 Jul 202609:16	–	nvd
Positive Technologies	PT-2026-55518	3 Jul 202600:00	–	ptsecurity

Vulners

Node

edge22 generateblocksRange≤2.2.1wordpress

[
  {
    "vendor": "edge22",
    "product": "GenerateBlocks",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "2.2.1",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/aac15273-0a5d-4107-8249-7fff7f503005
plugins	www.plugins.trac.wordpress.org/browser/generateblocks/tags/2.2.0/includes/blocks/class-headline.php
plugins	www.plugins.trac.wordpress.org/browser/generateblocks/tags/2.2.1/includes/blocks/class-headline.php
plugins	www.plugins.trac.wordpress.org/browser/generateblocks/tags/2.2.0/includes/class-dynamic-content.php
plugins	www.plugins.trac.wordpress.org/browser/generateblocks/tags/2.2.1/includes/class-dynamic-content.php
plugins	www.plugins.trac.wordpress.org/changeset
plugins	www.plugins.trac.wordpress.org/browser/generateblocks/tags/2.2.1/includes/class-dynamic-tag-security.php
plugins	www.plugins.trac.wordpress.org/browser/generateblocks/tags/2.2.0/includes/class-dynamic-tag-security.php

03 Jul 2026 09:16Current

6.1Medium risk

Vulners AI Score6.1

CVSS 3.16.4

CWE-79