The GenerateBlocks WordPress plugin before 1.4.0 does not validate the generateblocks/container block's tagName attribute, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks…
CVSS 3.1MEDIUM 5.4·Network·Low privileges·User interaction·EPSS 0.00624·Published 2021-11-29·Fixed in 1.4.0CWE-79