The GenerateBlocks plugin allows authenticated contributors or higher to insert arbitrary JavaScript into the headline block’s dynamic link attribute. By storing a payload in a contributor’s profile description and prefixing it with "javascript:", the plugin renders an attacker‑controlled href that is not escaped. When any site visitor clicks the rendered headline link, the injected script runs in their browser. The consequence is client‑side script execution, which could lead to malicious actions such as session hijacking, data exfiltration, or defacement depending on the attacker’s intent. These outcomes are inferred from the nature of the stored XSS vulnerability; the official description does not state them explicitly.

Any WordPress site running the GenerateBlocks plugin version 2.2.1 or earlier, with the headline block’s dynamic link attribute enabled, and a user with contributor or higher privileges, is susceptible. The plugin is authored by edge22 and distributed through the WordPress plugin repository. Versions newer than 2.2.1 are not reported as affected.

The CVSS score of 6.4 indicates medium severity. The EPSS score of <1% suggests that exploitation is currently considered unlikely, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated account with contributor-level access or higher; it is triggered when an authenticated user stores a malicious link and any visitor subsequently clicks that link. Once the payload is stored, it will be delivered to all users who view the affected page, executing arbitrary JavaScript in their browsers.