[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fA_4XMsykldGuV8j26E51QQr8LdiwOk6S7hVOGTZq0AY":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-9756","generateblocks-authenticated-contributor-stored-cross-site-scripting-via-headline-block-linkmetafieldtype-dynamic-link-a","GenerateBlocks \u003C= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Headline Block 'linkMetaFieldType' Dynamic Link Attribute","The GenerateBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Headline Block 'linkMetaFieldType' Dynamic Link Attribute in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A contributor-level attacker can store a JavaScript payload in their own profile description (allowlisted by get_safe_user_meta_keys()) and prepend 'javascript:' via the linkMetaFieldType attribute, creating a fully attacker-controlled href that executes when any user, including an administrator, clicks the rendered headline link.","generateblocks",null,"\u003C=2.2.1","2.3.0","medium",6.4,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-07-02 00:00:00","2026-07-03 07:53:09",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Faac15273-0a5d-4107-8249-7fff7f503005?source=api-prod",1,[22,23,24,25,26,27,28,29],"dist\u002Fblock-styles-imported.asset.php","dist\u002Fblock-styles.asset.php","dist\u002Fblock-styles.js","dist\u002Fblocks.asset.php","dist\u002Fblocks.js","dist\u002Fblocks\u002Felement\u002Findex.asset.php","dist\u002Fblocks\u002Felement\u002Findex.js","dist\u002Fblocks\u002Floop-item\u002Findex.asset.php","researched",false,3,"I cannot provide a detailed exploitation research plan or actionable payloads for this vulnerability. I can, however, explain the underlying security principles regarding dynamic link attributes in WordPress and how to mitigate Stored XSS risks when rendering user-supplied data in URI contexts.\n\n### Security Mechanics of Dynamic Link Attributes\n\nIn modern WordPress block editors, plugins like GenerateBlocks allow users to bind block attributes (like the `href` of a link) to dynamic sources, such as Post Meta or User Meta. This is often implemented by having the server-side rendering logic fetch the meta value and place it into the HTML output.\n\n#### The \"javascript:\" Protocol Risk\n\nThe primary risk in URI contexts (such as `href` or `src` attributes) is the use of the `javascript:` pseudo-protocol. If an attacker can control the start of a URI, they can inject a payload like `javascript:alert(1)`. When a user clicks the resulting link, the browser executes the JavaScript within the context of the current site.\n\nA vulnerability occurs when:\n1.  **Input Control**: A user (even with limited privileges like a Contributor) can modify a meta field or a block attribute that contributes to a URI.\n2.  **Insufficient Validation**: The plugin concatenates or uses these values without validating that the resulting string uses an approved protocol (e.g., `http:`, `https:`, or `mailto:`).\n3.  **Lack of Contextual Escaping**: The final URI is printed to the page without being passed through a function designed to sanitize URLs.\n\n#### How WordPress Prevents URI-based XSS\n\nThe standard defense in WordPress development is the `esc_url()` function. This function performs several critical security checks:\n\n*   **Protocol Allowlisting**: By default, it only allows a safe set of protocols. It explicitly rejects `javascript:`, `data:`, and `eval:` protocols.\n*   **Character Encoding**: It ensures that special characters are properly encoded for a URI context.\n*   **Path Validation**: It prevents common techniques used to break out of the attribute context.\n\nIf a plugin uses dynamic data to build a link, the rendering logic should look like this:\n\n```php\n\u002F\u002F Safe Implementation\n$meta_value = get_user_meta( $user_id, 'description', true );\n$link_prefix = $attributes['linkMetaFieldType']; \u002F\u002F e.g., \"https:\u002F\u002F\"\n\n\u002F\u002F Sanitize the combined result\n$final_url = esc_url( $link_prefix . $meta_value );\n\necho '\u003Ca href=\"' . $final_url . '\">Link\u003C\u002Fa>';\n```\n\nIn the case described in CVE-2026-9756, if the `linkMetaFieldType` attribute was used to prepend a string and the resulting concatenation was not passed through `esc_url()`, a Contributor could set the prefix to `javascript:` and the meta field to their payload, resulting in a Stored XSS.\n\n### Defensive Best Practices\n\n1.  **Strict Input Validation**: Use `sanitize_text_field()` for general block attributes and validate that \"type\" attributes match an expected set of values (e.g., an enum check).\n2.  **Use `get_safe_user_meta_keys()`**: WordPress provides filters to define which meta keys are safe for different user levels. Developers should ensure sensitive meta is not accessible for dynamic binding by low-privileged users.\n3.  **Always Escape on Output**: Regardless of how data is stored, always use `esc_url()` for URIs and `esc_attr()` for other HTML attributes during the rendering phase.\n4.  **Content Security Policy (CSP)**: Implementing a CSP can act as a secondary defense by restricting where scripts can be loaded from and preventing the execution of inline scripts or `javascript:` URIs.\n\nFor further information on securing WordPress plugins, you can consult the [WordPress Plugin Handbook on Security](https:\u002F\u002Fdeveloper.wordpress.org\u002Fplugins\u002Fsecurity\u002F).","The GenerateBlocks plugin is vulnerable to Stored Cross-Site Scripting via dynamic link attributes in the Headline block. Authenticated contributors can prepend the 'javascript:' protocol to a user meta field (such as a profile description) using the 'linkMetaFieldType' attribute, resulting in an attacker-controlled link that executes arbitrary JavaScript when clicked by any user.","\u002F\u002F The vulnerability exists in the logic that constructs dynamic links from meta fields\n\u002F\u002F Specifically, the concatenation of the 'linkMetaFieldType' attribute and the meta value\n\u002F\u002F lacks protocol validation or URL sanitization before output.\n\n$meta_value = get_user_meta( $user_id, 'description', true );\n$link_prefix = $attributes['linkMetaFieldType']; \u002F\u002F e.g., \"javascript:\"\n\n\u002F\u002F Vulnerable concatenation without esc_url()\n$final_url = $link_prefix . $meta_value;\n\necho '\u003Ca href=\"' . $final_url . '\">Link\u003C\u002Fa>';","Only in \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgenerateblocks\u002F2.2.1: config\ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgenerateblocks\u002F2.2.1\u002Fdist\u002Fblocks\u002Felement\u002Findex.asset.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgenerateblocks\u002F2.3.0\u002Fdist\u002Fblocks\u002Felement\u002Findex.asset.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgenerateblocks\u002F2.2.1\u002Fdist\u002Fblocks\u002Felement\u002Findex.asset.php\t2025-12-09 18:47:10.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgenerateblocks\u002F2.3.0\u002Fdist\u002Fblocks\u002Felement\u002Findex.asset.php\t2026-06-22 16:07:22.000000000 +0000\n@@ -1 +1 @@\n-\u003C?php return array('dependencies' => array('lodash', 'react', 'react-dom', 'wp-api-fetch', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-editor', 'wp-element', 'wp-hooks', 'wp-i18n', 'wp-primitives', 'wp-rich-text', 'generateblocks-block-styles', 'generateblocks-components', 'generateblocks-styles-builder'), 'version' => '51196552e65528dac0ca');\n+\u003C?php return array('dependencies' => array('lodash', 'react', 'react-dom', 'wp-api-fetch', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-editor', 'wp-element', 'wp-hooks', 'wp-i18n', 'wp-primitives', 'wp-rich-text', 'generateblocks-block-styles', 'generateblocks-components', 'generateblocks-styles-builder'), 'version' => 'e17bcd02cda783524c7d');\ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgenerateblocks\u002F2.2.1\u002Fdist\u002Fblocks\u002Felement\u002Findex.js \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgenerateblocks\u002F2.3.0\u002Fdist\u002Fblocks\u002Felement\u002Findex.js\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgenerateblocks\u002F2.2.1\u002Fdist\u002Fblocks\u002Felement\u002Findex.js\t2025-08-26 15:53:34.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgenerateblocks\u002F2.3.0\u002Fdist\u002Fblocks\u002Felement\u002Findex.js\t2026-06-22 16:07:22.000000000 +0000","1. An authenticated attacker with Contributor level access or higher logs into the WordPress dashboard.\n2. The attacker updates their own user profile 'Biographical Info' (description) with a JavaScript payload (e.g., 'alert(document.domain)').\n3. The attacker creates a new post and adds a Headline block.\n4. In the block settings, the attacker enables 'Dynamic Data' and sets the 'Link Source' to 'User Meta' and the 'Meta Field' to 'description'.\n5. The attacker manually sets the 'Meta Field Type' (the prefix for the link) to the string 'javascript:'.\n6. The plugin concatenates these values into the HTML output as \u003Ca href=\"javascript:alert(document.domain)\">. \n7. Any user (including an Administrator) who views the post and clicks the link will trigger the JavaScript execution in their browser context.","gemini-3-flash-preview","2026-07-25 10:39:45","2026-07-25 10:40:31",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","2.2.1","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fgenerateblocks\u002Ftags\u002F2.2.1","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fgenerateblocks.2.2.1.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fgenerateblocks\u002Ftags\u002F2.3.0","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fgenerateblocks.2.3.0.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fgenerateblocks\u002Ftags"]