Is CVE-2026-121773 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-121773 being exploited in the wild.

How severe is CVE-2026-121773?

Medium severity, with a CVSS score of 6.5, published 11 November 2026.

Which products and versions are affected?

GeneratePress GenerateBlocks up to 2.5.0.

Is there a fix for CVE-2026-121773?

Yes: fixed in 2.5.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-121773 attacked?

It is attacked over the network.

Am I affected by CVE-2026-121773?

Check whether you run GeneratePress GenerateBlocks at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-121773: GeneratePress GenerateBlocks stored cross-site scripting

CVE-2026-121773 · Severity: medium · CVSS 6.5 · Published 2026-11-11

GenerateBlocks is a WordPress plugin that provides page-building functionality through block-based editing. A stored cross-site scripting vulnerability in the plugin allows attackers to inject malicious scripts that can steal visitor data or hijack user accounts. Exploitation requires a contributor or higher privilege level to perform the attack.

Technologies: GeneratePress GenerateBlocks. Vendors: GeneratePress.

Quick answers

Is CVE-2026-121773 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-121773 being exploited in the wild.
How severe is CVE-2026-121773?: Medium severity, with a CVSS score of 6.5, published 11 November 2026.
Which products and versions are affected?: GeneratePress GenerateBlocks up to 2.5.0.
Is there a fix for CVE-2026-121773?: Yes: fixed in 2.5.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-121773 attacked?: It is attacked over the network.
Am I affected by CVE-2026-121773?: Check whether you run GeneratePress GenerateBlocks at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.5.1

Technical details

The vulnerability is an improper input neutralization flaw during web page generation, resulting in stored XSS. It affects GenerateBlocks up to version 2.5.0 and requires user interaction from a privileged account (contributor or developer role). Attackers can inject malicious scripts that persist in the site and execute in visitors' browsers.

Affected products

GeneratePress GenerateBlocks up to 2.5.0

Timeline

2026-11-02: disclosed: Vulnerability reported to Patchstack
2026-11-11: advisory: Published by Patchstack

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.