GenerateBlocks

Information

Software Type	Plugin
Software Slug	generateblocks (view on wordpress.org)
Software Status	Active
Software Author	edge22
Software Website	generateblocks.com
Software Downloads	3,515,525
Software Active Installs	200,000
Software Record Last Updated	July 13, 2026

8 Vulnerabilities

Submit a Vulnerability

GenerateBlocks <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Headline Block 'linkMetaFieldType' Dynamic Link Attribute

6.4

CVE-2026-9756

Jul 2, 2026

Researcher: Kirasec

GenerateBlocks <= 2.1.0 - Authenticated (Contributor+) Information Disclosure

4.3

CVE-2026-48877

May 27, 2026

Researcher: Abu Hurayra (HurayraIIT)

GenerateBlocks <= 2.2.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via Dynamic Tag Replacements

6.5

CVE-2026-3454

May 4, 2026

Researcher: kai63001

GenerateBlocks <= 2.1.2 - Authenticated (Contributor+) Information Exposure via Metadata

4.3

CVE-2025-12512

Dec 12, 2025

Researcher: Athiwat Tiprasaharn (Jitlada)

GenerateBlocks <= 2.1.1 - Improper Authorization to Authenticated (Contributor+) Arbitrary Options Disclosure

6.5

CVE-2025-11879

Oct 24, 2025

Researcher: Lucas Montes (NiRoX)

GenerateBlocks <= 1.9.1 - Authenticated (Contributor+) Sensitive Information Exposure via 'get_image_description'

4.3

CVE-2024-13546

Feb 28, 2025

Researcher: Nishiv

GenerateBlocks <= 1.8.2 - Sensitive Information Exposure

4.3

CVE-2024-1452

Mar 1, 2024

Researcher: Webbernaut

GenerateBlocks <= 1.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2021-24751

Nov 1, 2021

Researcher: apple502j

Title	Status	CVE ID	CVSS	Researchers	Date
GenerateBlocks <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Headline Block 'linkMetaFieldType' Dynamic Link Attribute	Patched	CVE-2026-9756	6.4	Kirasec	July 2, 2026
GenerateBlocks <= 2.1.0 - Authenticated (Contributor+) Information Disclosure	Patched	CVE-2026-48877	4.3	Abu Hurayra (HurayraIIT)	May 27, 2026
GenerateBlocks <= 2.2.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via Dynamic Tag Replacements	Patched	CVE-2026-3454	6.5	kai63001	May 4, 2026
GenerateBlocks <= 2.1.2 - Authenticated (Contributor+) Information Exposure via Metadata	Patched	CVE-2025-12512	4.3	Athiwat Tiprasaharn (Jitlada)	December 12, 2025
GenerateBlocks <= 2.1.1 - Improper Authorization to Authenticated (Contributor+) Arbitrary Options Disclosure	Patched	CVE-2025-11879	6.5	Lucas Montes (NiRoX)	October 24, 2025
GenerateBlocks <= 1.9.1 - Authenticated (Contributor+) Sensitive Information Exposure via 'get_image_description'	Patched	CVE-2024-13546	4.3	Nishiv	February 28, 2025
GenerateBlocks <= 1.8.2 - Sensitive Information Exposure	Patched	CVE-2024-1452	4.3	Webbernaut	March 1, 2024
GenerateBlocks <= 1.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting	Patched	CVE-2021-24751	6.4	apple502j	November 1, 2021

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation