{
    "title": "GenerateBlocks",
    "seo_title": "GenerateBlocks: review, recommended settings and limits",
    "h1": "GenerateBlocks",
    "description": "GenerateBlocks free or Pro: strengths, limitations, pricing, recommended settings and patched vulnerabilities, to help you decide and configure it well.",
    "lead": "GenerateBlocks adds a few highly configurable blocks to the WordPress editor, from containers to content queries, with CSS limited to the blocks you use. Our take on the free and Pro versions, the settings to choose and the vulnerabilities to know about on a multi-author site.",
    "language": "en",
    "locale": "en-US",
    "type": "plugin-sheet",
    "url": "https://www.wp-masquerade.com/features/camouflaged-plugins/generateblocks/",
    "canonical": "https://www.wp-masquerade.com/features/camouflaged-plugins/generateblocks/",
    "markdown": "https://www.wp-masquerade.com/features/camouflaged-plugins/generateblocks/index.md",
    "json": "https://www.wp-masquerade.com/features/camouflaged-plugins/generateblocks/index.json",
    "published": "2026-11-04T08:00:00+00:00",
    "modified": "2026-11-05T21:09:28+00:00",
    "site": {
        "name": "WP Masquerade",
        "url": "https://www.wp-masquerade.com/"
    },
    "translations": [
        {
            "language": "en",
            "hreflang": "en-US",
            "title": "GenerateBlocks",
            "url": "https://www.wp-masquerade.com/features/camouflaged-plugins/generateblocks/",
            "markdown": "https://www.wp-masquerade.com/features/camouflaged-plugins/generateblocks/index.md",
            "json": "https://www.wp-masquerade.com/features/camouflaged-plugins/generateblocks/index.json"
        },
        {
            "language": "fr",
            "hreflang": "fr-FR",
            "title": "GenerateBlocks",
            "url": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/generateblocks/",
            "markdown": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/generateblocks/index.md",
            "json": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/generateblocks/index.json"
        },
        {
            "language": "es",
            "hreflang": "es-ES",
            "title": "GenerateBlocks",
            "url": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/generateblocks/",
            "markdown": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/generateblocks/index.md",
            "json": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/generateblocks/index.json"
        },
        {
            "language": "de",
            "hreflang": "de-DE",
            "title": "GenerateBlocks",
            "url": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/generateblocks/",
            "markdown": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/generateblocks/index.md",
            "json": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/generateblocks/index.json"
        },
        {
            "language": "it",
            "hreflang": "it-IT",
            "title": "GenerateBlocks",
            "url": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/generateblocks/",
            "markdown": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/generateblocks/index.md",
            "json": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/generateblocks/index.json"
        },
        {
            "language": "pt",
            "hreflang": "pt-BR",
            "title": "GenerateBlocks",
            "url": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/generateblocks/",
            "markdown": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/generateblocks/index.md",
            "json": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/generateblocks/index.json"
        },
        {
            "language": "nl",
            "hreflang": "nl-NL",
            "title": "GenerateBlocks",
            "url": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/generateblocks/",
            "markdown": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/generateblocks/index.md",
            "json": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/generateblocks/index.json"
        }
    ],
    "headings": [
        {
            "level": 1,
            "text": "GenerateBlocks"
        },
        {
            "level": 2,
            "text": "What GenerateBlocks adds to the block editor"
        },
        {
            "level": 2,
            "text": "Which sites GenerateBlocks suits best"
        },
        {
            "level": 2,
            "text": "GenerateBlocks strengths and limitations"
        },
        {
            "level": 3,
            "text": "Strengths"
        },
        {
            "level": 3,
            "text": "Limitations"
        },
        {
            "level": 2,
            "text": "The settings we recommend for GenerateBlocks"
        },
        {
            "level": 2,
            "text": "GenerateBlocks security: flaws limited to logged-in accounts"
        },
        {
            "level": 2,
            "text": "GenerateBlocks FAQ",
            "id": "faq"
        }
    ],
    "body": "## The essentials\n\n- Best for building lean pages in the block editor, especially alongside the GeneratePress theme.\n- Main caveat: accordion, tabs, carousel, forms and global styles require the paid plan.\n- Free; Pro only comes with GeneratePress One, starting at $99 per year for one site.\n\n## What GenerateBlocks adds to the block editor\n\nGenerateBlocks adds its own block category to the WordPress editor, built on one idea: a few blocks, each highly configurable. Since version 2.0, everything rests on a handful of building blocks. The Element block works as a container or a grid, the Text block becomes a headline, a paragraph or a button, and the Media and Shape blocks add images and SVG shapes. The Query block lists content from any post type, with page numbers and a message when nothing is found. Every block shares the same style panel (layout, spacing, typography, colors, borders, effects), with separate values for desktop, tablet and mobile.\n\nDynamic tags pull the title, date, excerpt, featured image, author, terms or a custom field of a post into a block. On the front end, blocks are output as static HTML and CSS, and the plugin only generates CSS for the blocks on the page. Version 1 blocks (Container, Grid, Headline, Button) keep working wherever they are already in use.\n\nThe vendor is EDGE22 Studios Ltd., the company that also makes the [GeneratePress](https://www.wp-masquerade.com/features/camouflaged-plugins/generatepress/) theme. GenerateBlocks works with any theme. GenerateBlocks Pro, a separate plugin, adds global styles, design tokens, custom breakpoints, direct CSS editing, device visibility, extra dynamic tags and per-role block access. It is no longer sold on its own: it comes with the GeneratePress One plan.\n\n![Diagram: GenerateBlocks works on visitors and bots, wordpress, database and files. Public traces: folder name (hidden with Pro); tag IDs (hidden with Pro); generated-file folders (hidden with Pro); CSS classes (still visible).](https://www.wp-masquerade.com/media/wpm-sheets/generateblocks/diagram-en.svg?v=e082457f)\n\n## Which sites GenerateBlocks suits best\n\nGenerateBlocks is a good fit when you want to build pages in the block editor without a heavy page builder:\n\n- **Fast sites built on GeneratePress**: the two products are designed together, and the blocks’ maximum width follows the one set in the theme.\n- **Blogs and editorial sites**: the Query block and dynamic tags are enough for custom post lists, cards or category pages.\n- **Site builders comfortable with CSS**: the style panel fields map to CSS properties (grid, grid areas, positioning), which gives fine control without writing code.\n\nIt is not the best pick if you expect ready-made blocks in the free version: accordion, tabs, carousel, forms and popups require GeneratePress One. [Kadence Blocks](https://www.wp-masquerade.com/features/camouflaged-plugins/kadence-blocks/) offers more free blocks, including a form. If you are a beginner and prefer ready-made modules to CSS-like settings, expect a longer learning curve.\n\n## GenerateBlocks strengths and limitations\n\n### Strengths\n\n- **Few blocks to learn.** Element, Text, Media, Shape and Query cover most layouts, all with one style panel.\n- **Lean output.** Static HTML and CSS, with CSS only for the blocks used on the page.\n- **Free dynamic content.** The Query block and dynamic tags (custom fields, author, terms, featured image) are in the free version.\n- **Dynamic data under control.** Since version 2.4.0, only administrators and accounts allowed to post unfiltered HTML can add dynamic tags.\n\n### Limitations\n\n- **Few turnkey blocks.** Accordion, tabs, carousel, forms and popups require the paid plan.\n- **Pro is not sold separately.** GenerateBlocks Pro only comes with GeneratePress One, starting at $99 per year for one site.\n- **Global styles are paid.** Reusing a style or changing a color everywhere through a design token requires Pro; in the free version, each block is styled on its own.\n- **A run of vulnerabilities.** Six flaws fixed between versions 2.1.1 and 2.4.0, all exploitable from a Contributor account.\n- **Two generations of blocks.** On older sites, version 1 blocks stay in place next to the new ones, with different settings.\n\n## The settings we recommend for GenerateBlocks\n\nGenerateBlocks has few global settings, all under GenerateBlocks > Settings. The ones that matter most for security live in WordPress itself.\n\n| Setting | Recommended value | Why |\n| --- | --- | --- |\n| **Automatic updates**  Plugins > Installed Plugins > GenerateBlocks | Enabled | Six flaws were fixed between versions 2.1.1 and 2.4.0: updating quickly closes them. |\n| **Global max-width**  GenerateBlocks > Settings > Layout | Your theme’s content width | Containers line up with the rest of the site; with GeneratePress, this value is set in the Customizer. |\n| **Use version 1 blocks**  GenerateBlocks > Settings, “Version 1 blocks” section | Off (default) | Only the current blocks show up in the inserter; older blocks already in place still display. |\n| **Disable Google Fonts**  Same section | On (default) | Version 1 blocks then load no fonts from Google’s servers. |\n| **New User Default Role**  Settings > General | Subscriber | Every known flaw needs at least a Contributor account: only give that role to people you trust. |\n| **Editor and Administrator roles**  Users > All Users | Trusted people only | On a single site, these roles have the `unfiltered_html` capability, which allows adding dynamic tags since version 2.4.0. |\n\n- In Plugins, check that GenerateBlocks is at least version 2.4.0, the first one that fixes all the flaws listed below.\n- Open a page built with GenerateBlocks on a phone: containers should not overflow the screen width.\n- If you still use version 1 blocks, view a page’s source code: no `fonts.googleapis.com` address should appear.\n- With GenerateBlocks Pro, keep the Pro plugin updated too: it is distributed outside wordpress.org.\n\n## GenerateBlocks security: flaws limited to logged-in accounts\n\nPatchstack and WPScan list about ten vulnerabilities in GenerateBlocks, none exploitable without an account. Most target the plugin’s REST API or its dynamic tags, and all of them need at least a Contributor account. The most significant:\n\n- **CVE-2024-1452, fixed in 1.8.3**: through the Query block, a Contributor could read drafts, private posts and scheduled posts.\n- **CVE-2025-11879, fixed in 2.1.2**: a REST API route with no permission check let a Contributor read any WordPress option, including SMTP credentials or API keys.\n- **CVE-2026-3454, fixed in 2.2.1**: an [IDOR](https://www.wp-masquerade.com/glossary/idor/) flaw in the dynamic tags route exposed data from posts the Contributor had no access to.\n- **CVE-2026-13458, fixed in 2.4.0**: [stored XSS](https://www.wp-masquerade.com/glossary/xss/) by injecting dynamic tags into HTML attributes, from a Contributor account.\n\nIf you are the only person who logs in, the risk stays low; on a multi-author site, apply the least-privilege approach from our guide to WordPress roles and capabilities and turn on automatic updates (see our article on automatic plugin updates). WP Masquerade Pro renames the GenerateBlocks and GenerateBlocks Pro folders, the `generateblocks` script and stylesheet handle and the `uploads/generateblocks` folder, while the `gb-*` classes remain visible: this makes the plugin harder for bots to spot, but it does not replace updating.\n\n## GenerateBlocks FAQ\n\n**Do I need the GeneratePress theme to use GenerateBlocks?**\n\nNo. The vendor designs the two to work together, but GenerateBlocks runs with any theme. With GeneratePress, the blocks’ maximum width is simply taken from the theme’s Customizer.\n\n**Can I buy GenerateBlocks Pro on its own?**\n\nNo. GenerateBlocks Pro is included in GeneratePress One along with GP Premium, GenerateCloud and GeneratePress AI: $99 per year for one site, $149 per year for up to 10 sites, $199 per year for up to 100 sites, or $596 once for 100 sites. An existing GenerateBlocks Pro license keeps working and renewing.\n\n**Will my old GenerateBlocks blocks disappear?**\n\nNo. According to the vendor, version 1 blocks stay in place and work normally wherever they are used. The new blocks only replace them in the inserter, unless you turn on “Use version 1 blocks”.\n\n**GenerateBlocks or Kadence Blocks: which one should I choose?**\n\nGenerateBlocks bets on a few versatile blocks and lean output; Kadence Blocks offers more ready-made blocks in its free version, a form included. For another feature-rich collection, also look at [Spectra](https://www.wp-masquerade.com/features/camouflaged-plugins/spectra/).\n\n## Key facts\n\n- Category: Builders and themes\n- Vendor: EDGE22 Studios Ltd.\n- Price: Free; Pro included in GeneratePress One, starting at $99 per year for one site\n- Active installations (wordpress.org): 200 000+\n- Version: 2.5.0\n- Official page: https://wordpress.org/plugins/generateblocks/\n\n## What WP Masquerade hides\n\n- Handled by WP Masquerade Pro only\n- With Pro: folder name, tag IDs, generated-file folders\n- Still visible: CSS classes",
    "catalog": "generateblocks",
    "essentials": [
        "Best for building lean pages in the block editor, especially alongside the GeneratePress theme.",
        "Main caveat: accordion, tabs, carousel, forms and global styles require the paid plan.",
        "Free; Pro only comes with GeneratePress One, starting at $99 per year for one site."
    ],
    "format": "application/json"
}