What GenerateBlocks adds to the block editor
GenerateBlocks adds its own block category to the WordPress editor, built on one idea: a few blocks, each highly configurable. Since version 2.0, everything rests on a handful of building blocks. The Element block works as a container or a grid, the Text block becomes a headline, a paragraph or a button, and the Media and Shape blocks add images and SVG shapes. The Query block lists content from any post type, with page numbers and a message when nothing is found. Every block shares the same style panel (layout, spacing, typography, colors, borders, effects), with separate values for desktop, tablet and mobile.
Dynamic tags pull the title, date, excerpt, featured image, author, terms or a custom field of a post into a block. On the front end, blocks are output as static HTML and CSS, and the plugin only generates CSS for the blocks on the page. Version 1 blocks (Container, Grid, Headline, Button) keep working wherever they are already in use.
The vendor is EDGE22 Studios Ltd., the company that also makes the GeneratePress theme. GenerateBlocks works with any theme. GenerateBlocks Pro, a separate plugin, adds global styles, design tokens, custom breakpoints, direct CSS editing, device visibility, extra dynamic tags and per-role block access. It is no longer sold on its own: it comes with the GeneratePress One plan.
Which sites GenerateBlocks suits best
GenerateBlocks is a good fit when you want to build pages in the block editor without a heavy page builder:
- Fast sites built on GeneratePress: the two products are designed together, and the blocks’ maximum width follows the one set in the theme.
- Blogs and editorial sites: the Query block and dynamic tags are enough for custom post lists, cards or category pages.
- Site builders comfortable with CSS: the style panel fields map to CSS properties (grid, grid areas, positioning), which gives fine control without writing code.
It is not the best pick if you expect ready-made blocks in the free version: accordion, tabs, carousel, forms and popups require GeneratePress One. Kadence Blocks offers more free blocks, including a form. If you are a beginner and prefer ready-made modules to CSS-like settings, expect a longer learning curve.
GenerateBlocks strengths and limitations
Strengths
- Few blocks to learn. Element, Text, Media, Shape and Query cover most layouts, all with one style panel.
- Lean output. Static HTML and CSS, with CSS only for the blocks used on the page.
- Free dynamic content. The Query block and dynamic tags (custom fields, author, terms, featured image) are in the free version.
- Dynamic data under control. Since version 2.4.0, only administrators and accounts allowed to post unfiltered HTML can add dynamic tags.
Limitations
- Few turnkey blocks. Accordion, tabs, carousel, forms and popups require the paid plan.
- Pro is not sold separately. GenerateBlocks Pro only comes with GeneratePress One, starting at $99 per year for one site.
- Global styles are paid. Reusing a style or changing a color everywhere through a design token requires Pro; in the free version, each block is styled on its own.
- A run of vulnerabilities. Six flaws fixed between versions 2.1.1 and 2.4.0, all exploitable from a Contributor account.
- Two generations of blocks. On older sites, version 1 blocks stay in place next to the new ones, with different settings.
The settings we recommend for GenerateBlocks
GenerateBlocks has few global settings, all under GenerateBlocks > Settings. The ones that matter most for security live in WordPress itself.
| Setting | Recommended value | Why |
|---|---|---|
| Automatic updates Plugins > Installed Plugins > GenerateBlocks | Enabled | Six flaws were fixed between versions 2.1.1 and 2.4.0: updating quickly closes them. |
| Global max-width GenerateBlocks > Settings > Layout | Your theme’s content width | Containers line up with the rest of the site; with GeneratePress, this value is set in the Customizer. |
| Use version 1 blocks GenerateBlocks > Settings, “Version 1 blocks” section | Off (default) | Only the current blocks show up in the inserter; older blocks already in place still display. |
| Disable Google Fonts Same section | On (default) | Version 1 blocks then load no fonts from Google’s servers. |
| New User Default Role Settings > General | Subscriber | Every known flaw needs at least a Contributor account: only give that role to people you trust. |
| Editor and Administrator roles Users > All Users | Trusted people only | On a single site, these roles have the unfiltered_html capability, which allows adding dynamic tags since version 2.4.0. |
- In Plugins, check that GenerateBlocks is at least version 2.4.0, the first one that fixes all the flaws listed below.
- Open a page built with GenerateBlocks on a phone: containers should not overflow the screen width.
- If you still use version 1 blocks, view a page’s source code: no
fonts.googleapis.comaddress should appear. - With GenerateBlocks Pro, keep the Pro plugin updated too: it is distributed outside wordpress.org.
GenerateBlocks security: flaws limited to logged-in accounts
Patchstack and WPScan list about ten vulnerabilities in GenerateBlocks, none exploitable without an account. Most target the plugin’s REST API or its dynamic tags, and all of them need at least a Contributor account. The most significant:
- CVE-2024-1452, fixed in 1.8.3: through the Query block, a Contributor could read drafts, private posts and scheduled posts.
- CVE-2025-11879, fixed in 2.1.2: a REST API route with no permission check let a Contributor read any WordPress option, including SMTP credentials or API keys.
- CVE-2026-3454, fixed in 2.2.1: an IDOR flaw in the dynamic tags route exposed data from posts the Contributor had no access to.
- CVE-2026-13458, fixed in 2.4.0: stored XSS by injecting dynamic tags into HTML attributes, from a Contributor account.
If you are the only person who logs in, the risk stays low; on a multi-author site, apply the least-privilege approach from our guide to WordPress roles and capabilities and turn on automatic updates (see our article on automatic plugin updates). WP Masquerade Pro renames the GenerateBlocks and GenerateBlocks Pro folders, the generateblocks script and stylesheet handle and the uploads/generateblocks folder, while the gb-* classes remain visible: this makes the plugin harder for bots to spot, but it does not replace updating.
What WP Masquerade hides for GenerateBlocks
Pro Handled by WP Masquerade Pro only
The free version does not know the traces specific to GenerateBlocks: without Pro, only generator tags are removed, as for any plugin.
Free version
Handled by WP Masquerade Pro only
With Pro
- folder name
- tag IDs
- generated-file folders
Still visible
- CSS classes
gb-*
These traces stay because the plugin needs them to work (scripts, styles, cookies) or because they come from the server.
GenerateBlocks FAQ
Do I need the GeneratePress theme to use GenerateBlocks?
No. The vendor designs the two to work together, but GenerateBlocks runs with any theme. With GeneratePress, the blocks’ maximum width is simply taken from the theme’s Customizer.
Can I buy GenerateBlocks Pro on its own?
No. GenerateBlocks Pro is included in GeneratePress One along with GP Premium, GenerateCloud and GeneratePress AI: $99 per year for one site, $149 per year for up to 10 sites, $199 per year for up to 100 sites, or $596 once for 100 sites. An existing GenerateBlocks Pro license keeps working and renewing.
Will my old GenerateBlocks blocks disappear?
No. According to the vendor, version 1 blocks stay in place and work normally wherever they are used. The new blocks only replace them in the inserter, unless you turn on “Use version 1 blocks”.
GenerateBlocks or Kadence Blocks: which one should I choose?
GenerateBlocks bets on a few versatile blocks and lean output; Kadence Blocks offers more ready-made blocks in its free version, a form included. For another feature-rich collection, also look at Spectra.