Genesis Blocks – Authenticated Stored Cross-Site Scripting via Block Content – CVE-2024-1946 | WordPress Plugin Vulnerability Report 

Plugin Name: Genesis Blocks

Key Information:

  • Software Type: Plugin
  • Software Slug: genesis-blocks
  • Software Status: Active
  • Software Author: StudioPress
  • Software Downloads: 1,333,603
  • Active Installs: 100,000
  • Last Updated: April 2, 2024
  • Patched Versions: 3.1.3
  • Affected Versions: <= 3.1.2

Vulnerability Details:

  • Name: Genesis Blocks <= 3.1.2
  • Title: Authenticated (Contributor+) Stored Cross-Site Scripting via Block Content
  • Type: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
  • CVE: CVE-2024-1946
  • CVSS Score: 6.4
  • Publicly Published: April 1, 2024
  • Researcher: Ngô Thiên An (ancorn_) - VNPT-VCI
  • Description: The Genesis Blocks plugin for WordPress, a tool designed to enhance content creation with custom blocks, has been found vulnerable to Stored Cross-Site Scripting (XSS) attacks. This vulnerability is present in all versions up to and including 3.1.2 and results from inadequate input sanitization and output escaping in the block content, enabling attackers with contributor-level access or higher to inject malicious scripts.


Genesis Blocks, an essential plugin for many WordPress users, harbors a critical security flaw in versions up to 3.1.2, identified as CVE-2024-1946. This flaw facilitates Stored Cross-Site Scripting attacks through the plugin's custom block content, posing a significant risk to website integrity and user security. The development team has addressed this issue in the updated version 3.1.3, urging users to implement this crucial patch.

Detailed Overview:

Discovered by security researcher Ngô Thiên An, this vulnerability exposes websites to potential unauthorized script executions, which could compromise sensitive user data, deface website content, or conduct phishing attacks. The nature of Stored XSS means the malicious code is embedded directly into the website’s database, triggering each time the affected content is loaded, thereby extending the attack's reach to multiple users. The update to version 3.1.3 is a pivotal step in mitigating this risk and securing WordPress sites using Genesis Blocks.

Advice for Users:

  • Immediate Action: Users of Genesis Blocks should promptly update to version 3.1.3 to neutralize this vulnerability and protect their sites from potential exploits.
  • Check for Signs of Vulnerability: Administrators are advised to review their sites for unusual content modifications or unauthorized script injections as indicators of compromise.
  • Alternate Plugins: While the patched version offers a secure solution, users may explore alternative content creation plugins as an additional precaution.
  • Stay Updated: Ensuring all WordPress plugins are consistently updated to their latest versions is vital in maintaining site security and resilience against emerging threats.


The rapid remediation of CVE-2024-1946 by the Genesis Blocks developers underscores the imperative of timely software updates in the realm of website security. By adopting version 3.1.3 or later, users can fortify their WordPress installations against this and other vulnerabilities, thereby safeguarding their digital assets in an increasingly hostile cyber environment.


Detailed Report: 

In today's digital ecosystem, a website serves as more than just a digital footprint; it is a critical facet of your brand's identity and credibility. This reality is starkly illuminated by the recent discovery of a significant vulnerability within the Genesis Blocks plugin, a staple in the WordPress community for enhancing site content. Designated as CVE-2024-1946, this vulnerability not only underscores the latent threats in seemingly benign digital tools but also emphasizes the critical importance of regular website maintenance to safeguard against potential security breaches.

About Genesis Blocks Plugin:

Developed by StudioPress, Genesis Blocks enriches WordPress sites with over 1.3 million downloads and a user base exceeding 100,000. Renowned for its versatility in content creation, the plugin recently came under scrutiny when security researchers Ngô Thiên An and the team at VNPT-VCI uncovered a Stored Cross-Site Scripting (XSS) vulnerability in versions up to and including 3.1.2.

Vulnerability Details:

  • CVE-2024-1946: This vulnerability stems from insufficient sanitization and output escaping within the plugin's block content, allowing attackers with contributor-level access to inject malicious scripts. These scripts can execute unauthorized commands, access sensitive data, or compromise site integrity.
  • Impact: The potential ramifications are extensive, ranging from data breaches to compromised user trust and reputational damage.

Mitigating the Vulnerability:

The developers at StudioPress acted swiftly to rectify the issue, releasing patch version 3.1.3. Users of Genesis Blocks are urged to update to this version immediately to protect their sites from potential exploitation.

Historical Context:

Genesis Blocks isn't unfamiliar with vulnerabilities; six have been reported since June 2023. This history highlights the ongoing battle against cyber threats and the importance of vigilance.


The rapid resolution of CVE-2024-1946 by the Genesis Blocks team serves as a critical reminder of the importance of keeping software up to date. For small business owners, managing a WordPress site amidst numerous other duties, the task of staying abreast of such vulnerabilities may seem daunting. Yet, the consequences of neglecting website security can be far more severe. Leveraging automated updates, utilizing security plugins, and staying informed through reputable cybersecurity news sources can significantly alleviate the burden, ensuring that your website remains secure and trustworthy in an ever-evolving digital landscape. In the realm of cybersecurity, proactive measures and timely updates are not just best practices but essential strategies for safeguarding your digital presence.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

Genesis Blocks – Authenticated Stored Cross-Site Scripting via Block Content – CVE-2024-1946 | WordPress Plugin Vulnerability Report FAQs

Leave a Comment