The GenerateBlocks plugin contains a flaw in the headline block’s ‘linkMetaFieldType’ attribute that does not properly sanitize or escape user input. An attacker with contributor‑level or higher WordPress privileges can place a JavaScript payload in their own profile description, which the plugin allows as part of user meta. By prefixing the payload with the string \"javascript:\" the attacker creates a fully attacker‑controlled href that is stored in the database and rendered unchanged. When any site visitor follows the headline link, the injected script runs in their browser, potentially allowing the attacker to steal session cookies, deface the site, or perform other client‑side attacks. This is a classic stored XSS vulnerability, classified as CWE‑79.

Any WordPress installation that has the GenerateBlocks plugin version 2.2.1 or older, with the headline block’s dynamic link attribute enabled, is vulnerable. The plugin is authored by edge22 and distributed via the WordPress plugin repository. Versions newer than 2.2.1 have not been indicated as affected.

The CVSS score of 6.4 indicates a medium severity vulnerability. The EPSS score of <1% shows that exploitation is currently considered unlikely, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated account with contributor‑level access or higher and is triggered when any visitor clicks the compromised headline link. Once the payload is stored, it will be delivered to all site users who view the affected page, executing arbitrary JavaScript in their browsers.