The GenerateBlocks WordPress plugin is vulnerable to stored cross-site scripting via the Headline Block's linkMetaFieldType dynamic link attribute in all versions up to and including 2.2.1. Authenticated attackers with contributor-level privileges can inject JavaScript payloads by leveraging their profile description metadata, which is allowlisted by get_safe_user_meta_keys(). By prepending 'javascript:' to the linkMetaFieldType attribute, attackers create fully controlled href attributes that execute arbitrary scripts when clicked by any user, including administrators. This vulnerability arises from insufficient input sanitization and output escaping in the plugin's handling of dynamic link attributes.

An attacker with contributor-level access can inject persistent malicious scripts into pages via the Headline Block's dynamic link attribute. These scripts execute in the context of users who view or interact with the injected content, potentially leading to session hijacking, privilege escalation, or other client-side impacts. The vulnerability does not require user interaction beyond clicking the malicious link, and it affects confidentiality and integrity but not availability. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and partial impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and avoid using the Headline Block's dynamic link feature with untrusted input. Monitor vendor channels for updates and apply patches promptly once released.